FIFA World Cup 2026, a global playground for cybercriminals

Over the past twelve months, 84% of professional sports organizations have been affected by at least one cyber incident. This is cause for concern for the massive FIFA World Cup currently underway, a priority that must be taken seriously, explains Cynthia Overby, Director of Strategic Security Solutions at Rocket Software, a company specializing in IT infrastructure optimization. Host cities: a boon for public Wi-Fi networks. "World Cup host cities are currently welcoming millions of people, including players, officials, event sponsors, and media personnel," says Overby. "Since many rely heavily on connected devices and public networks, the tournament creates an unmissable opportunity for cybercriminals to exploit. Smartphones, laptops, and other internet-connected devices are particularly vulnerable to attacks, especially when users connect to unsecured Wi-Fi networks." Phishing and counterfeits: the trap comes to the living room. Even in the comfort of one's living room, the danger remains. "Cybercriminals are also conducting large-scale phishing campaigns via fake ticket offers, counterfeit merchandise sites, and spoofed communications to trick fans into disclosing sensitive personal and financial information," she continues. Infrastructure isolation and the Zero Trust model. And she proposes some solutions: "To secure the World Cup both digitally and physically, organizers must implement a multi-layered defense and proactive security protocols." This begins with the implementation of email authentication across all official tournament and vendor domains, as well as the isolation of operational technologies, such as stadium lighting, HVAC (heating, ventilation, and air conditioning) systems, and digital signage, from corporate IT systems and public Wi-Fi networks. Finally, a brief note on surveillance: "Organizers must adopt a zero-trust model for identity, requiring strict multi-factor authentication and minimal privileged access controls for all third-party providers managing physical infrastructure, to prevent unauthorized access during the event."