12 Million Compromised Streaming Accounts for 2026 World Cup Appear on Dark Web

More than 12 million compromised user accounts tied to 10 streaming services for the 2026 FIFA World Cup have appeared on the dark web, representing nearly $220 million in potential sales. The tournament, hosted jointly by the United States, Canada and Mexico, expanded to 48 teams and spans 16 cities.

Viewership has risen with each round, as Spain’s semifinal win over France drew 11.46 million viewers on Fox and Argentina’s semifinal victory over England reached 15.06 million the next day.

On June 27, the final day of the group stage, threat actors released a record 802,000 compromised accounts in a single day. That release generated an estimated $14.8 million in potential single-day revenue, according to HUMAN Security’s Satori Threat Intelligence team.

Lindsay Kaye, VP of threat intelligence at HUMAN Security, said rising prices for the accounts indicate growing demand from fans seeking lower-cost access. “If somebody doesn’t want to pay $30, $40, or $50, they can pay $5 and have access to that streaming service in order to watch the World Cup,” she said.

Ian Ballon, co-chair of Greenberg Traurig LLP’s global intellectual property and technology practice group, said rights owners can prepare by monitoring streams at known game times. “Rights owners have to plan in advance, so that they know when infringement is discovered and what to do and how to act quickly to disable an unauthorized stream,” he said.

Fubo stated that it systematically investigates reports of suspicious activity and may strengthen security measures when unexpected behavior appears. The company said it monitors unusual geolocation patterns that can indicate account sharing or compromise.