Summary
Cybercriminals are taking advantage of the 2026 FIFA World Cup by selling stolen streaming accounts on the dark web. A new report from HUMAN Security found over 12 million compromised accounts from 10 streaming services, worth nearly $220 million on the black market. As more fans look for cheap ways to watch matches, hackers are increasing both the number of stolen accounts and their prices.
Main Impact
The growing demand for World Cup broadcasts is fueling a hidden market for stolen streaming credentials. On June 27, the last day of the group stage, hackers released a record 802,000 compromised accounts in a single day. This could have generated an estimated $14.8 million in black-market sales. The trend shows that cybercriminals treat major events like the World Cup as a business opportunity, expanding their supply as consumer interest grows.
Key Details
What Happened
HUMAN Security's Satori Threat Intelligence team tracked more than 12 million stolen user accounts tied to 10 streaming services that broadcast World Cup matches. These accounts were found on dark web marketplaces, where sellers offer them for as little as $5 each. The stolen accounts often come with extras like linked payment cards, loyalty points, premium subscriptions, and even warranties that promise replacements if buyers lose access.
Important Numbers and Facts
The 2026 World Cup is the largest in history, with 48 national teams and 16 host cities across the U.S., Canada, and Mexico. Viewership records have been broken during the tournament. Spain's semifinal win over France drew 11.46 million viewers on Fox, while Argentina's semifinal victory over England reached 15.06 million viewers. The final is expected to set another record. While some matches aired free on broadcast TV, others required a cable or streaming subscription, creating demand for cheaper access.
Background and Context
Cybercriminals commonly obtain stolen usernames and passwords from the dark web or use malware to extract credentials saved on victims' devices. These credentials are then resold on dark web marketplaces. The problem is not new, but major events like the World Cup create a spike in demand. Lindsay Kaye, VP of threat intelligence at HUMAN Security, said that if someone does not want to pay $30 to $50 for a legitimate subscription, they can pay $5 for a stolen account. This makes the black market attractive for budget-conscious fans.
Public or Industry Reaction
Streaming platforms say they are taking steps to protect accounts. Fubo, one of the services mentioned, said it prepares for high-profile events months in advance. The company monitors platform activity more closely during high-traffic periods and looks for unusual geolocation patterns, such as the same account appearing in two distant locations at the same time. Fox Sports, NBC Sports, Telemundo, FIFA, YouTube TV, and DirecTV did not respond to requests for comment. Ian Ballon, a lawyer specializing in intellectual property, said rights owners must plan ahead to quickly disable unauthorized streams during live events.
What This Means Going Forward
The rise in stolen streaming accounts puts pressure on broadcasters and streaming platforms to improve security. Tools like two-factor authentication and bot prevention can make it harder for hackers to steal and sell accounts. However, experts say the black market for credentials will likely continue as long as there is demand for cheaper access. Fans should be cautious about buying discounted subscriptions from unofficial sources, as these accounts are often stolen and can be shut down at any time.
Final Take
The World Cup is a prime target for cybercriminals because of its massive global audience. While streaming platforms are working to protect their users, the underground market for stolen accounts shows no signs of slowing down. Fans who want to watch the tournament safely should stick to legitimate services and avoid deals that seem too good to be true.
Frequently Asked Questions
How do cybercriminals steal streaming accounts?
They often use stolen usernames and passwords from the dark web or malware that extracts credentials saved on victims' devices. These credentials are then sold on dark web marketplaces.
Why are stolen streaming accounts popular during the World Cup?
Many matches require a cable or streaming subscription, which can cost $30 to $50 per month. Stolen accounts are sold for as little as $5, making them an attractive option for fans who want to watch without paying full price.
What can streaming platforms do to stop this?
Platforms can use tools like two-factor authentication, bot prevention software, and geolocation monitoring to detect and block suspicious activity. They also prepare for high-profile events by increasing monitoring and quickly shutting down unauthorized streams.
