Loading story…
A threat actor allegedly leaked data from the Asian Football Confederation (AFC) and records tied to Al Nassr FC, claiming exposure of more than 150,000 player, coach, and member records on a cybercrime forum and the dark web. Reported samples included passport scans and numbers, contracts, verified email addresses, AFC registration files, AFC IDs, and detailed player information such as names, dates of birth, nationalities, club affiliations, match details, and venue data. The seller called it the "largest breach in football history" and invoked ShinyHunters, but Dataminr assessed that reference as likely an attempt to borrow the group’s reputation rather than evidence of direct affiliation.
Researchers warned that the combination of identity documents, contract data, and verified contact information could enable identity fraud, business email compromise, contract manipulation, and highly targeted social engineering against athletes, coaches, and officials. Dataminr also noted that some allegedly leaked documents included diplomatic passports, expanding the potential impact beyond sports operations to tournament logistics and broader national security concerns as AFC member nations prepare for the 2026 FIFA World Cup. At the time of reporting, the AFC had not publicly commented on the alleged compromise, while security experts urged organizations to review athlete-data storage, third-party access, financial verification workflows, and monitoring for suspicious communications.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
By April 29-30, 2026, multiple outlets reported the alleged breach publicly, describing it as potentially the largest breach in football history and noting sample records tied to AFC and Al Nassr FC. At the time of reporting, the Asian Football Confederation had not publicly commented on the incident.
Researchers reported that the alleged leak included passport scans and numbers, verified email addresses, contracts, AFC IDs, registration files, and detailed player and coach information. They warned the data could enable identity fraud, business email compromise, contract manipulation, and targeted social engineering against athletes, staff, and officials.
On April 27, 2026, a threat actor allegedly posted a leaked archive on a prominent cybercrime forum, claiming to have data from the Asian Football Confederation and Al Nassr FC affecting more than 150,000 player and coach records. The actor referenced ShinyHunters, though reporting assessed this as likely an attempt to borrow the group's reputation rather than evidence of direct affiliation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcelinkedin.com
Open sourceupguard.com
Open sourcetechradar.com
Open sourcedataminr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Argentine Football Association (**AFA**) is investigating a suspected compromise after attackers allegedly used credentials stolen from a software developer’s device infected with an infostealer in September 2025. The intrusion surfaced when mass emails were sent from legitimate AFA domains falsely claiming Argentina had “stolen” a World Cup win from Egypt, indicating unauthorized access to internal systems. Security researchers at Hudson Rock said the stolen credentials may have enabled broad administrative access across AFA assets, including databases, management portals, media infrastructure, and the competition system. Data later advertised on cybercrime forums was said to include staff, club, and partner information, along with internal email addresses, phone numbers, user roles, registration timestamps, subdomain access listings, and some plaintext passwords. Hudson Rock also reported that weak password reuse across internal systems likely worsened the breach’s impact by allowing wider lateral access once the initial credentials were obtained. AFA acknowledged possible unauthorized access and said it is investigating the incident and implementing security measures.
Jul 14, 2026
AFC Ajax disclosed a breach after an unknown hacker exploited vulnerabilities in the club’s app and website, including exposed APIs and shared access keys, to access parts of its IT systems. Ajax said the incident exposed email addresses belonging to a few hundred people, while records for fewer than 20 individuals subject to stadium bans included names, email addresses, and dates of birth. The club said it patched the flaws, engaged external experts to investigate, filed a police report, and notified the Dutch Data Protection Authority. Reporting on the incident indicated the weaknesses could have allowed access to private data tied to more than **300,000** registered Ajax fans, as well as tampering with stadium-ban records and the theft or disabling of more than **42,000** season tickets. Ajax said the breach was brought to its attention by an RTL journalist who had been contacted by the hacker, and added that it had no indication the data had been further distributed, while warning supporters to watch for spam and phishing emails.
Jun 29, 2026
The French Football Federation (FFF) suffered a significant cyberattack in which threat actors exploited a compromised user account to access the federation’s administrative management software. This breach resulted in the theft of sensitive personal data belonging to over two million registered amateur football players and club members, including names, dates and places of birth, nationalities, postal and email addresses, phone numbers, and football license numbers. Financial data and passwords were reportedly not affected. Upon discovering the breach on November 20, 2025, the FFF immediately deactivated the compromised account, reset all user passwords, and secured its systems. The FFF has filed a formal complaint with French authorities and notified both the National Cybersecurity Agency (ANSSI) and the National Commission on Informatics and Liberty (CNIL). Affected individuals whose email addresses were exposed are being contacted directly, and the federation has urged all members to be vigilant against potential phishing attempts and scams leveraging the stolen data. This incident highlights the growing cyber risks faced by sports organizations and underscores the need for robust cybersecurity measures to protect large volumes of personal information managed by such entities.
Jul 12, 2026