Loading story…
Super Bowl LX at Levi’s Stadium is being supported by a large, multi-agency security operation, with the NFL and the U.S. Department of Homeland Security coordinating extensive federal, state, and local participation under a Tier 1 Special Event Assessment Rating (SEAR) designation. Planning has been underway for roughly 18 months, and officials described a broad security footprint extending beyond game day to surrounding events in the San Francisco Bay Area.
From a cyber perspective, a threat assessment reported no specific, credible cyber threats currently targeting Super Bowl LX, but warned that high-visibility events commonly drive opportunistic cybercrime aimed at fans and attendees—particularly phishing, scams, malware, and payment-card fraud tied to tickets, travel, and event-related promotions. The assessment also pointed to prior sports-related incidents (e.g., a team online store compromise and a ransomware attack on an NFL team in a prior Super Bowl lead-up) as context for why organizers and partners should expect social engineering and impersonation attempts even absent indications of targeted attacks on league infrastructure.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Super Bowl LX was set to take place on February 8, 2026, at Levi’s Stadium in Santa Clara, drawing heightened cyber, physical, and public-safety preparations because of the event’s scale and profile.
Airspace protections were put in place around Levi’s Stadium, including temporary flight restrictions and an FAA/FBI-designated 'No Drone Zone' for the Super Bowl.
Officials coordinated a large security operation for Super Bowl LX across nine Bay Area counties, with participation from agencies including DHS, Secret Service, ATF, CBP, CISA, TSA, and regional emergency services.
Analysts observed online sentiment and protest-related chatter tied to alleged ICE activity and controversy around performers, including plans for a protest near the stadium on game day, but no calls for violence were identified.
Flashpoint said it had not observed any specific cyber threats targeting Super Bowl LX, while warning that opportunistic phishing, scams, malware, fraud, impersonation, and social engineering could still target attendees and related populations.
Super Bowl LX received a DHS tier one Special Event Assessment Rating, also described as SEAR-1, triggering significant federal support and layered security preparations.
Planning for Super Bowl LX security began about 18 months before the event, involving the NFL and more than 35 state, local, and federal agencies across the San Francisco Bay Area.
The Green Bay Packers' online store was compromised in 2024, another historical sports-related cyber incident referenced in threat assessments for Super Bowl LX.
The San Francisco 49ers were hit by a BlackByte ransomware attack ahead of Super Bowl LVI, later cited as a historical example of sports-related cyber risk relevant to major events like the Super Bowl.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 warned that the **2026 FIFA World Cup** will present an unusually broad cyberattack surface because the tournament spans 16 host cities across the United States, Canada, and Mexico and will depend on temporary event networks layered onto existing stadium and municipal systems. The report said likely targets extend beyond venues to **transit, power, water, airports, emergency services, hotels, suppliers, ticketing platforms, and official digital services**, creating multiple paths for disruptive intrusions during the competition window. The assessment identified **Iran-linked actors**, including **Handala Hack Team** and **CyberAv3ngers**, as notable risks for destructive activity and **OT/PLC** targeting, while **NoName057(16)** was highlighted for politically timed **DDoS** campaigns. Unit 42 said financially motivated cybercrime is also likely to focus on hospitality and fan-facing services through ransomware and fraud, and it urged organizers and host-city partners to strengthen multi-jurisdiction coordination, harden OT environments, audit suppliers, prepare DDoS defenses, run destructive-malware exercises, and tighten identity and help-desk controls before kickoff.
Jun 29, 2026
Professional sports organizations are facing sustained cyber targeting, with Darktrace reporting that **84%** were targeted in the past year and **57%** experienced multiple incidents. The sector has become an attractive target because disruption during live events can have immediate operational and reputational impact, while teams, leagues, venues, and partners also hold valuable fan, athlete, and commercial data. Increased digitization across stadium operations, broadcasting, ticketing, and cloud services has expanded the attack surface and heightened dependence on interconnected third parties. Phishing emerged as a leading threat vector, with sports organizations receiving **19% more phishing emails** than other sectors. Darktrace said **21%** of analyzed phishing messages targeted executives or VIPs, **37%** used novel AI-assisted social engineering techniques, and **84%** bypassed **DMARC** authentication checks. The reporting also warned that supply-chain exposure through ticketing platforms, broadcasters, cloud providers, and stadium technology vendors is compounding risk for the sports sector as attackers look for ways to disrupt events, steal sensitive data, and exploit trusted business relationships.
Aug 11, 2026
Reporting highlighted elevated cyber risk around the upcoming **Milano Cortina Winter Games**, with threat researchers warning that high-visibility events attract a broad mix of adversaries including **hacktivists**, **cybercriminals**, and **state-linked espionage actors**. Expected activity includes disruption of Wi-Fi and event digital infrastructure, **DDoS**, and **ransomware/extortion**, alongside intelligence collection targeting high-profile attendees (politicians, executives, celebrities) and event-adjacent **critical infrastructure** such as utilities, transit, ticketing, and point-of-sale systems. Separate threat reporting indicated a shift in **Oceania (Australia/New Zealand/South Pacific)** where 2025 activity disproportionately impacted “Main Street” sectors—especially **retail**, **construction**, and **professional services**—rather than traditionally prioritized critical sectors. The reporting attributed part of this trend to the growing market for **sold network access** (initial access brokerage), citing dozens of tracked access sales affecting Australian and New Zealand organizations, with retail the most frequently impacted; this is distinct from an industry-focused blog post ranking Chinese cybersecurity firms, which is not tied to a specific incident or threat campaign.
Jun 29, 2026