How the World Cup showed the power of the AI-era of cyberthreats

The FIFA World Cup 2026, with 104 matches across 16 host cities, following a 2022 edition that engaged five billion people, was one of the largest cybersecurity stress tests of the year.

It put billions of people, devices, and transactions online simultaneously, with temporary networks layered onto existing infrastructure, hundreds of suppliers connecting into shared systems, and dependencies compounding at every integration point.

This mass convergence drove a massive surge in cyber-enabled fraud, AI-driven social engineering, and targeted phishing campaign. According to research form CTI, Ithe tournament triggered a 120% surge versus past World Cups in localized cyber threat activity and established lasting shifts in cybercrime tactic

Netskope observed that at its peak, the number of users attempting to access malicious World Cup content was nearly 6-times the pre-tournament average. Over the course of the tournament, Netskope detected and stopped more than 28,000 World Cup-themed threats spanning more than 1,000 organizations worldwide.

The Tournament Behind the Tournament

At the 2018 PyeongChang Winter Olympics, "Olympic Destroyer" malware struck during the opening ceremony, taking down Wi-Fi, ticketing, and the official website. At the 2024 Paris Olympics, French authorities confirmed 140 cyber incidents including 22 intrusions and a ransomware attack against the Grand Palais.

For 2026, the targeting began early. Canada's Centre for Cyber Security has logged more than 4,300 likely-fraudulent FIFA-themed domain registrations in May, a month before the World Cup kicked off. While the FBI issued a public alert warning of typo-squatted domains such as fiffa.com and jobs-fifa.com built to harvest payment data from fans buying tickets and hospitality.

The scale of threat and complete impact of the World Cup’s surging cyberattacks and related fraud has yet to be fully calculates but CTI projected a total commercial financial impacts across peripheral sports organizations, vendors, and local booking sectors to exceed $500 million globally over the tournament timeline.

A World Cup Shaped by Autonomous Systems

For cybersecurity experts, what's different in 2026 are the systems running underneath. The official match ball streams roughly 500 readings a second to an AI that calls offside in real time. In past tournaments, people decided and machines executed. This time, software does both.

That shift runs across ticketing, payments, access control, and broadcast. The 2026 World Cup is among the first to run while AI agents operate inside enterprise workflows, initiating transactions, moving data, and escalating privileges without human approval. Veeam research from June 2026 found that 88% of organizations are already using or piloting AI agents, yet only 7% qualify as truly AI-ready. The rest are acting on unverified data, in systems they don't fully see.

Agents make decisions across platforms at machine speed. An attacker who compromises one, via prompt injection, credential theft, or a poisoned data feed, doesn't need a human mistake. The agent acts for them. Recovery is no longer just restoring systems. It's tracing which decisions were made on bad inputs and how far the damage spread.

The Infrastructure Behind the Spectacle

The 2026 edition is the first World Cup hosted by three nations, with 16 cities from Vancouver to Miami, each with its own temporary networks wiring into shared tournament platforms. Events like this are pop-up enterprises, new systems integrated with existing infrastructure under time pressure.

That’s where exposure multiplies, with shared credentials, rushed deployments, uneven patching, and limited visibility across dozens of partners. The harder problem is data integrity. Organizations lose track of where it sits, which systems write to it, and whether what they'd restore is clean. Fast detection can still leave teams burning days verifying data is safe to act on. At a live tournament, that window doesn't exist. Prevention is still necessary, but no longer enough.

Recovery Over Prevention

Around events like the World Cup, the security conversation leans too heavily on prevention. At this scale, disruption is far more likely to involve SaaS platforms, cloud control planes, and third-party services that no single team controls. Prevention has no answer when an agent acts on poisoned data or a partner is compromised mid-match. Recovery does.

Recovery has to mean more than restoring systems. It has to mean restoring trust, bringing services back online on data you can prove is clean, with controls that can stop the bleeding before it spreads.

90% of organizations say they are confident they can recover from a cyber incident, but recent research tells a different story. Fewer than one in three ransomware victims fully recovered their data, with just 72% restored on average. At a live event, confidence without proof is a liability.

Before kickoff, operators should be able to demonstrate four things across on-premises, cloud, and SaaS. Restore a specific service in minutes without rebuilding entire environments. Prove data is clean before any agent or human acts on it. Rotate credentials and revoke tokens at the speed of an incident, not a ticket queue. And contain a misbehaving agent the moment its inputs become untrustworthy, without taking the tournament offline.

Teams that rarely rehearse these capabilities default to what they discussed when pressure hits, not what they proved. The test is making fast, correct decisions when the world is watching.

Visibility and Control Under Pressure

For Asia-Pacific organizations, regulation adds another layer. Australia's Privacy Act, Singapore's PDPA, and Japan's APPI each impose strict breach-notification timelines, harder to meet under the pressure of a global event.

The fragmented approach many companies take, with identity here, access there, compliance elsewhere, recovery somewhere else, wasn't built for autonomous agents acting before any human reviews them. Closing those gaps is operational, not architectural. It means knowing data is clean, ensuring agents operate on verified information, and being able to recover to a known-good state.

The winners off the pitch will be those whose systems run on verified data, whose recoveries are clean, and whose response keeps the football the story.

By Dave Russell, Senior Vice President, Head of Strategy

Dave drives Veeam’s vision for products and services, research, and community engagement programs globally.
A 35-year veteran in the storage industry, Dave joined Veeam in May 2018 as Vice President of Enterprise Strategy. Prior to Veeam, he held the role of Vice President and Distinguished Analyst at Gartner, focusing on storage strategies and technologies, with an emphasis on backup/recovery, and was also the lead author of Magic Quadrant for Data Center Backup & Recovery Solutions from 2005 to 2018.
Before Gartner, Dave spent over 15 years at IBM in Storage Research and Development as a Software Engineer in mainframe backup/recovery and as a manager of Product Development, Architecture, and Strategy teams for distributed systems backup/recovery and storage solutions.