Stolen Streaming Accounts Drain $220M During World Cup
More than 12 million compromised streaming accounts tied to the 2026 World Cup are circulating on the dark web, exposing a $220 million black market that undermines broadcaster revenues and pressures platforms to increase security spending.
Cybercriminals are exploiting surging demand for the 2026 FIFA World Cup by flooding the dark web with stolen streaming credentials. Security researchers at HUMAN Security identified over 12 million compromised accounts across 10 broadcasting services. The underground inventory represents nearly $220 million in potential black-market sales.
As viewership milestones are broken—peaking at 15.06 million viewers for Argentina’s semifinal victory over England on Fox—thieves are treating the tournament as a supply-and-demand exercise. Threat actors are actively raising prices for stolen logins as the tournament progresses. On June 27 alone, the final day of the group stage, criminals released a record 802,000 compromised accounts, generating an estimated $14.8 million in potential single-day revenue.
The arbitrage opportunity stems from the fragmented broadcasting model. While some matches aired free on U.S. broadcast television, others required cable or streaming subscriptions. “If somebody doesn’t want to pay $30, $40, or $50, they can pay $5 and have access to that streaming service in order to watch the World Cup,” said Lindsay Kaye, VP of threat intelligence at HUMAN Security.
For streaming platforms and rights holders, this black market directly erodes subscription revenue during their most lucrative window. Broadcasters are forced to treat live sports as a security crisis as much as a programming event. “When you have an event like the World Cup, rights owners know in advance when the games are going to be, and it’s possible to be extra vigilant around the times of games to monitor for infringement and then to act quickly,” said Ian Ballon, co-chair of Greenberg Traurig LLP’s global intellectual property and technology practice group.
Shutting down unauthorized streams requires significant operational overhead. Fubo, one of the affected streaming platforms, stated it prepares for high-profile events months in advance. “The team monitors platform activity even more closely than usual during high-traffic periods, across all layers of the service,” the company said, noting it tracks unusual geolocation patterns to detect compromised accounts.
The 2026 tournament, expanded to 48 teams across North America, has created an unprecedented scale of viewership that will likely normalize this criminal economy. Even with defensive tools like two-factor authentication, executives face a permanent structural threat. “There’s never going to be a situation that I see in which there is no market for credentials,” Kaye said. “People will always want to be able to buy these accounts, get something for less.”
