Stolen streaming accounts surge as World Cup viewership rises

Cybercriminals are selling access to stolen streaming accounts as World Cup audiences climb and fans look for cheaper ways to watch matches, according to research from HUMAN Security. The firm’s Satori Threat Intelligence team found more than 12 million compromised accounts linked to 10 streaming services carrying World Cup games.

Those accounts could represent nearly $220 million in potential black-market sales, HUMAN said. The firm said sellers increased both the volume of accounts offered and their prices as demand for World Cup matches grew.

The 2026 tournament, jointly hosted by the U.S., Canada and Mexico, is the first World Cup staged across three countries and the first in North America since 1994, according to Fortune. FIFA expanded the field from 32 to 48 national teams, making this the largest edition of the competition.

Fortune reported that the event has drawn large television audiences as it moves toward the final. Spain’s semifinal win over France drew 11.46 million viewers on Fox, and Argentina’s semifinal victory over England reached 15.06 million viewers a day later, according to the report.

Dark web sellers follow match demand

Many World Cup matches were available on free broadcast television in the U.S., while others required cable or streaming subscriptions, Fortune reported. HUMAN said that gap helped create demand for discounted, unauthorized access to paid services.

On June 27, the final day of the group stage, threat actors posted a record 802,000 compromised accounts, HUMAN said. The firm estimated those listings could have generated $14.8 million in potential black-market revenue in one day.

Lindsay Kaye, HUMAN Security’s vice president of threat intelligence, told Fortune that higher prices for stolen accounts point to stronger demand from fans seeking cheaper access. “If somebody doesn’t want to pay $30, $40, or $50, they can pay $5 and have access to that streaming service in order to watch the World Cup,” she said.

HUMAN said it could not determine exactly how the accounts were compromised. Kaye told Fortune that cybercriminals often use usernames and passwords already circulating on the dark web or credentials taken by malware that steals data saved on victims’ devices.

Those credentials are then resold on dark web marketplaces, where sellers may advertise linked payment cards, loyalty points, premium subscriptions and replacement warranties if buyers lose access, according to Fortune.

Platforms face pressure to move quickly

The spread of stolen accounts puts pressure on broadcasters and streaming services to protect users and cut off unauthorized streams during live matches. Ian Ballon, co-chair of Greenberg Traurig LLP’s global intellectual property and technology practice group, told Fortune that rights owners can prepare because match times are known in advance.

Ballon said live sports leave little time to respond once infringement begins. He told Fortune that rights holders need plans for identifying violations and disabling unauthorized streams quickly.

Fox Sports, NBC Sports, Telemundo, FIFA, YouTube TV and DirecTV did not immediately respond to Fortune’s requests for comment. Fubo told Fortune it investigates suspicious account activity and may add security measures when it detects unexpected behavior.

Fubo said it prepares for high-profile events months ahead of time and watches platform activity more closely during high-traffic periods. The company also told Fortune it monitors unusual geolocation patterns, including cases where the same account appears in distant locations over a short span.

Kaye said companies can make stolen accounts harder to use with two-factor authentication and bot-prevention tools. She told Fortune she does not expect the credential market to disappear because buyers will keep looking for cheaper access.

This story draws on original reporting from Fortune.