The World Is Coming
to the U.S.
Is Your Organization
Ready?

Major Global Events Are Proven Targets for Coordinated Cyberattacks

The FIFA World Cup ran June 11 through July 19, 2026, across 16 host cities in the U.S., Mexico, and Canada — and the threat landscape played out largely as predicted. Security researchers tracked over a million leaked credentials tied to the tournament, ransomware activity against hospitality providers, and DDoS attacks that knocked regional ticketing portals offline. Threat actors had infrastructure staged and waiting for months before kickoff, including large volumes of fraudulent domains impersonating FIFA-branded ticketing, merchandise, and job sites.

The takeaway for organizations gearing up for Super Bowl LXI and the LA28 Olympics: this is not a hypothetical risk. It is a documented pattern, and it repeats with every major global event, at greater scale each time.

For SLED organizations and critical infrastructure operators, the stakes are especially high. A successful cyberattack — particularly one targeting identity systems — doesn't just disrupt IT. It disrupts public services, emergency operations, and community trust in real time, in front of a global audience.

It's also important to understand that host-city exposure doesn't stay in the host city. The infrastructure supporting these events — power, telecommunications, financial networks, supply chains, emergency services — is deeply interconnected across state lines. U.S. organizations well outside California should expect to see the same probing activity in the run-up to the next two events.

Preparedness isn't optional. And the window to act is now.