Report Warns of the Expanding Scope of Cyber Attacks Surrounding the 2026 World Cup

SadaNews - As the kickoff of the 2026 FIFA World Cup approaches, the risks surrounding the tournament are no longer limited to stadium security or crowd management. A new report from Unit 42 of Palo Alto Networks suggests that the world's largest sporting event may also become one of the broadest areas of cyber attack, not only due to the number of matches and fans, but also because each match will rely on a complex network of temporary and permanent systems, municipal services, and digital supply chains.

Unprecedented Scale of the Tournament

The 2026 edition will take place over 39 days, from June 11 to July 19, in 16 cities across 3 countries: the United States, Canada, and Mexico. The tournament will feature 48 teams and 104 matches, with an expected attendance of between 5 and 6 million fans in the stadiums, alongside a global broadcast audience nearing half of the world's population. The report notes that this edition will be the first to be jointly organized by three countries, which means a multiplicity of regulatory bodies, languages, infrastructures, and local systems associated with the event.

The report states that the danger is not limited to the stadiums alone; each match will be managed through a "multi-loop temporary network" that is added to existing environments in stadiums typically used for leagues such as the NFL, MLS, CFL, and Liga MX. This network does not operate in isolation from the city, but rather relies on public transport services, traffic signals, water, sewage, electricity, airports, and emergency services.

According to the report, each of these points could fall within the interest of cyber adversaries.

Three Drivers of Risk

Unit 42 identifies three main drivers of risk. The first is associated with cyber activities attributed to groups linked to Iran, especially following the escalation of regional tensions in 2026, which led to campaigns targeting exposed American infrastructure online, including industrial control units in the water, energy, and municipal services sectors. The second is associated with Russian-backed hacking; the report indicates that the group "NoName057(16)" has carried out more than 3,700 documented distributed denial-of-service attacks against governments and critical sectors in NATO member countries since 2022. The third involves cybercrime driven by financial motives, ranging from ticket fraud to ransomware attacks against the hospitality sector.

Historical numbers provide context for these concerns; during the 2022 World Cup in Qatar, "Group-IB" detected over 16,000 fraudulent domains, more than 40 fake applications, and over 50 fake social media accounts, in addition to 90 hacked accounts on the fan portal "Hayya." At the 2024 Paris Olympics, the French cyber security agency confirmed over 140 cyber events, including 22 successful breaches, alongside a ransomware attack against the "Grand Palais" and around 40 museums.

Despite competitions not being disrupted, the report attributes this to preparations that began years ago, including training related to about 500 facilities connected to the games.

Direct Targeting of Fans

For fans, financial crime represents the highest risk in terms of scale and likelihood. The report highlights five main categories of ticket-related fraud, which include counterfeit resale websites, fake social media accounts, phishing messages through contests or giveaways, fake applications within official app stores, and credential stuffing attacks against fan portals.

It also points to other risks surrounding accommodation and hospitality, digital hotel keys, point of sale, and fraud related to "QR" codes for transportation, parking, and mobility permits.

Complex Supply Chain

The attack surface expands due to the multi-city nature of the tournament; each host city will independently contract with suppliers for stadium operations, security, transportation, hospitality, food services, signage, fan zones, and local communication networks.

The report reminds of the "Olympic Destroyer" attack in Pyeongchang (2018); whereby the "Wi-Fi" systems, official website, ticketing systems, and broadcast drones were compromised, affecting over 300 systems before service was restored 12 hours later. The report uses this precedent to warn that suppliers could become an entry point for an attack before targeting the organizing entity itself.

Interconnected Digital Loops

The report divides the tournament's digital infrastructure into multiple loops, each with a different risk. The loop for gameplay, refereeing, and video technology may face threats impacting competition integrity or broadcasting at a critical moment. The stadium operations loop may include entry and ticket scanning, screens, public announcements, "Wi-Fi," and credentials. The tournament management loop encompasses schedules, results, statistics, and broadcasting. The business loop includes hospitality, payment, and loyalty systems, while the fan-facing loop involves applications for "Vega," ticketing, broadcasting, and digital accounts. Above all, the services of the host city, such as transportation, energy, water, and airports, remain part of the risks associated with the event.

More Sensitive Scenarios

The report does not rule out more sensitive scenarios, including disruptions to operational systems in a municipal facility before a significant match or a ransomware attack against a major hotel chain during the final week of the tournament, which could affect room access, mobile check-ins, and point-of-sale systems for 48 to 72 hours. The report recommends pre-training with hotels, clear verification protocols for technical support offices, and offline operational plans for property management systems.

The 2026 World Cup will not only be a logistical and sports test but also a test of interconnected digital infrastructure between stadiums, cities, suppliers, and fans. The potential attack no longer targets a single location or application, but an entire ecosystem involving ticketing, identity, hospitality, transportation, payments, and operational structure. In an event of this scale, readiness is measured not only by organizers' ability to prevent an attack but also by their capacity to swiftly contain it and prevent it from escalating into a disruption affecting the fan experience, operational safety, or public trust.