Cybercriminals leaked 802,000 stolen accounts in a single day amidst the World Cup group stage.

      HUMAN Security has discovered over 12 million stolen streaming accounts connected to World Cup broadcasts on the dark web, valued at approximately $220 million. As demand for the tournament increases, sellers are boosting their prices. The Satori Threat Intelligence team from HUMAN Security tracked these compromised accounts across 10 streaming services that provide tournament coverage. On June 27, the final day of the group stage, a staggering 802,000 accounts were leaked in just one day, potentially generating around $14.8 million in revenue.

      The sellers are treating the World Cup similarly to a major retail event, increasing their inventory and prices as interest rises. Stolen accounts can be found for as low as $5, while legitimate subscriptions typically range from $30 to $50. Some advertisements also offer linked payment cards, loyalty points, premium services, and warranties for replacement accounts if access is lost. Lindsay Kaye, VP of threat intelligence at HUMAN Security, noted that demand is increasing as fans look for cheaper viewing options.

      These accounts were likely acquired through credential stuffing attacks using stolen usernames and passwords from the dark web or via info-stealing malware that captures credentials saved on victims’ devices. Prior to the tournament, more than 4,300 fraudulent FIFA domains and banking malware concealed in streaming applications were already targeting World Cup enthusiasts. The market for stolen accounts functions as a distinct aspect of the overall system, profiting from credentials instead of phishing new ones.

      Fubo reported that it prepares for such high-traffic events well in advance and monitors for suspicious geolocation activities, such as a single account being accessed from two distant locations quickly. Fox Sports, NBC Sports, Telemundo, FIFA, YouTube TV, and DirecTV have not responded to inquiries for comments. In May, Italian law enforcement confiscated a piracy application that streamed services like Sky, DAZN, and Netflix through compromised legitimate accounts, highlighting that credential-based piracy is an escalating enforcement challenge beyond just the World Cup. With the final match scheduled between Spain and Argentina, which is anticipated to set another viewership record, the market for stolen accounts is nearing its end, although these credentials will persist beyond the tournament.