FIFA World Cup: A cyber criminal’s cash cow

IBC

article here

Alongside financially motivated cyber crime, politically motivated hacktivists are also likely to target organisations linked to the tournament through distributed denial-of-service attacks, website defacements and disinformation campaigns.

The FIFA World Cup will be the largest, most digitally connected sporting event ever staged. Billions of viewers, millions of devices, sprawling broadcast infrastructure, and a three‑nation footprint create a perfect storm of opportunity for cyber-attack.

“This tournament will face more sophisticated, more automated, and more politically charged cyber-attacks than any event before it,” warns Darren Anstee, CTO for security at Netscout.

The scale of the tournament across the U.S, Canada and Mexico dramatically increases the potential attack surface for criminals and hacktivists alike.

Matt Hull, VP of Cyber Intelligence and Response at Manchester-headquartered global cyber security firm, NCC Group says the 2026 World Cup will present cyber criminals with “the biggest opportunity to make money this year”, as threat actors increasingly exploit global sporting events for fraud, disruption and political activism.

All the host nations recorded an increase in the weekly average number of cyber-attacks  in April 2026 compared to both March 2026 and April 2025.

A history of attacks

Cyber-attacks targeting major sporting events are nothing new. “Pretty much every single one of them over the last 20 years has seen attack activity,” Anstee explains. The severity varies depending on geopolitics, the host nation, and even the sponsors involved.

During the 2022 World Cup in Qatar, a China-linked crime group reportedly hacked into a major telecommunications provider, syphoning customer data and with potential to blackout live streaming of the games. Cybercriminals stole personal data from 15000 Uefa customers during Euros 2024; the French authorities recorded over 500 cybersecurity events during the Paris Olympics and earlier this year, Russian hackers targeted foreign ministry offices and Winter Olympics sites, including hotels in Cortina.

Anstee explains that attackers begin probing infrastructure six months before the event and ramp up again three months out.

“During the event, attacks spike around opening ceremonies, closing ceremonies, and high‑profile matches,” he says. “Some attackers aim for real disruption like taking services offline and keeping them down. Others simply want attention, using the global spotlight to amplify their political or ideological message.”

What makes 2026 different is the combination of geopolitical tension, automation, and scale. The last five years have seen a surge in activist‑driven cyberattacks linked to conflicts in Ukraine, the Middle East, and other flashpoints.

“This is a great opportunity for activists to get out their messages,” Hull says. “Being able to take down services that are associated with this event to impact the reputation of North America in general.”

DDoS

A major concern are Distributed Denial of Service (DDoS) attacks where the aim is to disrupt or take down the live stream. Netscout has identified over 100 groups actively using DDoS as a tool. Their attack campaigns, which can last days or many weeks, fall into three major categories.

Anstee explains, “The ones grabbing the headlines happen when the network is flooded by 20-30 terabits designed to overwhelm connectivity. If you fill the pipe everything behind it is unreachable.”

So-called ‘state‑exhaustion’ attacks target firewalls and load balancers with extremely high packet rates, overwhelming their ability to track connections.

The most sophisticated, and the hardest to detect, are application‑layer attacks. In this type of attack, bots behave like real users. They connect over TLS, even logging in and issuing queries.

“They are mimicking normal behaviour but at scale, they crush the application’s ability to serve legitimate users,” Anstee says. “There are also more supply‑chain dependencies and more legitimate traffic sources making geolocation filtering harder. It makes the threat surface bigger and it makes simple things harder.”

Every digital service associated with the tournament represents a potential target for DDoS. Not just for financially motivated attackers, but also for politically and ideologically driven actors looking to make a statement on the world stage “in the most-viewed country-versus-country competition.”

Streaming and broadcast platforms

Rights‑holders worldwide are on high alert. They’ve paid enormous sums for exclusive distribution rights and attackers know that knocking out a national broadcaster during a key match would cause chaos.

“You might not even need to hit the media itself,” Anstee says. “If you can’t log into your TV service, you can’t watch the match.”

Attackers increasingly target secondary vendors upstream of major services which are likely to be less defended. Anstee explains, “If I knock one of them over, what’s the downstream impact? Does it slow things down? Stop things in certain regions?”

With the World Cup spread across three countries, the supply chain is larger and more complex than ever.

Rather than directly targeting FIFA infrastructure, many attacks are expected to focus on the wider ecosystem supporting the event, including airlines, transport operators, hotels, payment systems and ticketing providers.

“All of the things that are critical to making the event a success are likely to be targeted,” Hull says. “How bad would it be if you can’t fly over to North America because one of your flights has been cancelled because of some activist activity? Or you’re over there and you can’t buy your tickets?”

Criminals are already using the World Cup as bait in phishing campaigns and fake online stores.

“We’re starting to see through some of our research phishing links being used with the World Cup as context, fake merchandise sites being spun up to buy kits.”

Automated attack

The rise of artificial intelligence has also made cyber fraud more convincing and easier to scale.

“Gone are the days of the dodgy phishing email that’s badly written,” Hull says. “AI-generated websites, deepfake videos, fraudulent betting platforms, and fake social media content could all be used to support scams or spread disinformation during the tournament.”

For consumers, the primary risks are likely to be ticket scams, fake merchandise websites and payment fraud. But Hull also warns that successful cyber attacks on infrastructure providers could create wider disruption for travellers and fans.

“It’s going to be scams essentially. Or they’re going to be losing money because they bought a dodgy ticket or they’ve purchased from a website that isn’t legitimate.”

More alarming is the rise of AI‑driven attack tools using chatbots.

“A novice can now orchestrate a complex, multi‑stage attack with a single instruction: ‘Disrupt this service tomorrow during business hours’,” Anstee says

Chatbots can automatically run reconnaissance to select the most vulnerable points of attacks. They can be programmed to launch attacks at scheduled times, monitor the ‘success’ or otherwise and adjust tactics on the fly.

Botnets like Mirai variants (a range of malware), and the AISURU botnet (reportedly the most powerful ever), and others now include millions of compromised devices. “You don’t need high‑rate traffic anymore,” Anstee explains. “If you’ve got a million and a half devices, each doing a tiny amount, you can generate enormous impact.”

Parking the bus

The role of cybersecurity specialists is to support the service providers, broadcasters, and sponsors who form the digital backbone of the tournament.

“No single layer can stop every attack,” says Anstee. “A 30‑terabit flood must be handled by the service provider, not the enterprise. But small, stealthy application‑layer attacks must be caught at the enterprise edge.

Over 540 service providers feed data to Netscout every hour, generating intelligence on 16 million attacks per year. This allows the company to identify active botnets, track attack infrastructure and feed intelligence back to customers in realtime.

Coordination is important too. For events like the World Cup, service providers, vendors, sponsors, and governments are sharing information. “It’s one of the reasons you haven’t seen major outages so far,” Anstee notes.

For major organisations involved in the tournament, Hull advises cyber preparedness should focus on “doing the basics right”, including password security, resilience testing and incident response planning. But he also stressed the importance of preparing staff for increasingly sophisticated social engineering attacks.

Hull says, “Major sporting events like this combine huge digital dependency with emotional public engagement and that creates ideal conditions for cyber-attacks and online scams.”