World Cup Fuels Black Market for Stolen Streaming Accounts

Cybercriminals are capitalizing on the 2026 FIFA World Cup by selling compromised streaming accounts on the dark web, according to research from HUMAN Security's Satori Threat Intelligence team. The tournament, hosted by the U.S., Canada, and Mexico, has seen a surge in demand for access to matches, with some games requiring cable or streaming subscriptions. This demand has fueled an underground market where stolen credentials are being sold at inflated prices.

The research identified over 12 million compromised user accounts across 10 streaming services broadcasting World Cup matches. These accounts represent a potential black-market value of nearly $220 million. Threat actors have been actively increasing both the volume of accounts offered and their asking prices as the tournament progresses and viewership benchmarks are repeatedly broken. For instance, Spain's semifinal victory over France drew 11.46 million viewers on Fox, a record at the time, which was then surpassed by Argentina's semifinal win with 15.06 million viewers.

A significant spike in account sales occurred on June 27, the final day of the group stage. On this single day, threat actors released a record 802,000 compromised accounts, generating an estimated $14.8 million in potential sales. This activity highlights the direct correlation between major sporting events and the escalation of cybercrime targeting digital services. The expanded 48-team format and the 16 host cities across North America have contributed to the widespread viewership and, consequently, the increased opportunities for illicit account trading.