12 Million Compromised Streaming Accounts for 2026 World Cup Matches Appear on Dark Web

More than 12 million compromised user accounts linked to 10 streaming services broadcasting 2026 World Cup matches have surfaced on the dark web, Fortune reported. The accounts carry an estimated potential value of nearly $220 million in black-market sales.

The 2026 tournament is hosted jointly by the United States, Canada and Mexico across 16 cities including Kansas City, Guadalajara and Toronto.

It is the first time North America has hosted the event since 1994 and the first expanded to 48 national teams. Viewership has risen with the expanded field. Spain’s semifinal win over France drew 11.46 million viewers on Fox, while Argentina’s semifinal victory over England reached 15.06 million the following day.

On June 27, the final day of the group stage, threat actors released a record 802,000 compromised accounts in a single day, generating an estimated $14.8 million in potential revenue, according to HUMAN Security’s Satori Threat Intelligence team. Lindsay Kaye, VP of threat intelligence at HUMAN Security, said rising prices for the accounts indicate growing demand from fans seeking lower-cost access.

“If somebody doesn’t want to pay $30, $40, or $50, they can pay $5 and have access to that streaming service in order to watch the World Cup,” she said.

Kaye added that a market for credentials will persist because buyers continue to seek discounted access. Ian Ballon, co-chair of Greenberg Traurig LLP’s global intellectual property and technology practice group, said rights owners can prepare by monitoring around known game times and acting quickly to disable unauthorized streams.