Russia and Iran are expected to target the FIFA World Cup as part of a broader anti-US posture, according to global threat intelligence experts - raising significant concerns for insurers with exposure to cyber, event cancellation, and critical infrastructure risks across the three host nations.
This year's tournament, taking place across the United States, Canada, and Mexico, is likely to be subject to acts of cyber terrorism, while drone use could fuel domestic physical threats, security experts told City AM, which first reported the story.
Unit 42's report, "Discussing the world's biggest game's attack surface," found that Russia-linked threat actors have previously targeted NATO members and major international events, including the Ukraine Peace Summit and the Paris and Milan Olympic Games. Two of the three World Cup host nations - the US and Canada - are NATO members.
Iranian hackers have reportedly been targeting small municipal authorities in ways that could impact water, wastewater, and energy infrastructure across host cities - a threat profile with direct implications for business continuity and property underwriters.
Unit 42's Justin Moore told City AM that "geopolitical tensions mean we are monitoring active interest from state-backed and proxy threat actors," adding that "Russia may have been banned from competition, but it's been running cyber interference in global sport since long before Ukraine."
Moore said Iran presents a similarly broad threat: "From destructive attacks to disinformation, Iran is running a full campaign, and the World Cup could be a target given the highly volatile geopolitical climate."
While state-sponsored interference is a serious concern, Moore cautioned that the highest volume of malicious cyber activity is likely to come from a different direction entirely.
"Cybercriminals get excited by the mass exploitation of worldwide sporting events because they're great at exploiting human psychology for financial gain," he said. "While hacktivists may attempt disruptive DDoS attacks to garner headlines, the overwhelming volume of cyber activity we anticipate will actually come from everyday, financially motivated cybercriminals deploying ransomware and ticketing scams."
Moore added: "The risk isn't about an inevitable disruption, but rather a reminder of why early, coordinated digital readiness across the entire host-city ecosystem is so critical."
The World Cup, which begins next month, has already attracted controversy over immigration, visas, ticketing, transportation, and geopolitical stances. Iran will be competing despite the ongoing conflict in the Middle East, with matches slated for the West Coast of the United States. Russia remains banned from the tournament, though President Trump raised the prospect of their reinstatement earlier in the World Cup cycle amid Ukraine-related peace talks.
The convergence of elevated cyber threat activity, infrastructure vulnerabilities, and mass public gatherings across multiple jurisdictions represents a materially complex exposure landscape heading into the tournament.
