Loading story…
The Argentine Football Association (AFA) is investigating a suspected compromise after attackers allegedly used credentials stolen from a software developer’s device infected with an infostealer in September 2025. The intrusion surfaced when mass emails were sent from legitimate AFA domains falsely claiming Argentina had “stolen” a World Cup win from Egypt, indicating unauthorized access to internal systems. Security researchers at Hudson Rock said the stolen credentials may have enabled broad administrative access across AFA assets, including databases, management portals, media infrastructure, and the competition system.
Data later advertised on cybercrime forums was said to include staff, club, and partner information, along with internal email addresses, phone numbers, user roles, registration timestamps, subdomain access listings, and some plaintext passwords. Hudson Rock also reported that weak password reuse across internal systems likely worsened the breach’s impact by allowing wider lateral access once the initial credentials were obtained. AFA acknowledged possible unauthorized access and said it is investigating the incident and implementing security measures.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The Argentine Football Association acknowledged possible unauthorized access to its systems and said it was investigating the incident while implementing security measures.
Following the apparent intrusion, posts on cybercrime forums advertised AFA data for sale, including staff, club, and partner information, internal email addresses, phone numbers, user roles, registration timestamps, subdomain access listings, and some plaintext passwords.
The suspected breach became visible after mass emails were sent from legitimate AFA domains claiming Argentina had stolen a World Cup win from Egypt, indicating unauthorized access to AFA infrastructure.
Hudson Rock said the suspected compromise chain began when an infostealer infected a software developer’s device tied to the Argentine Football Association, potentially exposing credentials later used to access AFA systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor allegedly leaked data from the Asian Football Confederation (**AFC**) and records tied to **Al Nassr FC**, claiming exposure of more than **150,000** player, coach, and member records on a cybercrime forum and the dark web. Reported samples included passport scans and numbers, contracts, verified email addresses, AFC registration files, AFC IDs, and detailed player information such as names, dates of birth, nationalities, club affiliations, match details, and venue data. The seller called it the "largest breach in football history" and invoked **ShinyHunters**, but Dataminr assessed that reference as likely an attempt to borrow the group’s reputation rather than evidence of direct affiliation. Researchers warned that the combination of identity documents, contract data, and verified contact information could enable **identity fraud**, **business email compromise**, contract manipulation, and highly targeted social engineering against athletes, coaches, and officials. Dataminr also noted that some allegedly leaked documents included diplomatic passports, expanding the potential impact beyond sports operations to tournament logistics and broader national security concerns as AFC member nations prepare for the 2026 FIFA World Cup. At the time of reporting, the AFC had not publicly commented on the alleged compromise, while security experts urged organizations to review athlete-data storage, third-party access, financial verification workflows, and monitoring for suspicious communications.
Jun 29, 2026
The French Football Federation (FFF) suffered a significant cyberattack in which threat actors exploited a compromised user account to access the federation’s administrative management software. This breach resulted in the theft of sensitive personal data belonging to over two million registered amateur football players and club members, including names, dates and places of birth, nationalities, postal and email addresses, phone numbers, and football license numbers. Financial data and passwords were reportedly not affected. Upon discovering the breach on November 20, 2025, the FFF immediately deactivated the compromised account, reset all user passwords, and secured its systems. The FFF has filed a formal complaint with French authorities and notified both the National Cybersecurity Agency (ANSSI) and the National Commission on Informatics and Liberty (CNIL). Affected individuals whose email addresses were exposed are being contacted directly, and the federation has urged all members to be vigilant against potential phishing attempts and scams leveraging the stolen data. This incident highlights the growing cyber risks faced by sports organizations and underscores the need for robust cybersecurity measures to protect large volumes of personal information managed by such entities.
Jul 12, 2026
AFC Ajax disclosed a breach after an unknown hacker exploited vulnerabilities in the club’s app and website, including exposed APIs and shared access keys, to access parts of its IT systems. Ajax said the incident exposed email addresses belonging to a few hundred people, while records for fewer than 20 individuals subject to stadium bans included names, email addresses, and dates of birth. The club said it patched the flaws, engaged external experts to investigate, filed a police report, and notified the Dutch Data Protection Authority. Reporting on the incident indicated the weaknesses could have allowed access to private data tied to more than **300,000** registered Ajax fans, as well as tampering with stadium-ban records and the theft or disabling of more than **42,000** season tickets. Ajax said the breach was brought to its attention by an RTL journalist who had been contacted by the hacker, and added that it had no indication the data had been further distributed, while warning supporters to watch for spam and phishing emails.
Jun 29, 2026