World Cup streaming credential leak: 802,000 accounts released in one day

On June 27, the final day of the World Cup group stage, threat actors released 802,000 stolen streaming accounts in a single day. The accounts were part of a larger cache of 12 million compromised credentials tied to the tournament, according to HUMAN Security's Satori Threat Intelligence team.

The 12 million accounts represent a potential black-market value of nearly $220 million. Individual accounts sell for as little as $5, compared to legitimate subscriptions that cost $30 to $50.

Credential market operates like a retail event

The sellers are treating the World Cup like any high-demand retail season. They expand inventory and raise prices as consumer interest peaks. Some listings advertise linked payment cards, loyalty points, premium tiers, and warranties promising replacement accounts if buyers lose access.

• 802,000 accounts released on June 27 alone, generating an estimated $14.8 million in potential revenue.
• Accounts were likely obtained through credential-stuffing attacks using stolen usernames and passwords already on the dark web, or through info-stealing malware.
• Over 4,300 fake FIFA domains and banking malware hidden in streaming apps were already targeting fans before the tournament kicked off.
• At least 10 streaming services carrying tournament matches had accounts compromised.

Enforcement challenges persist after the final whistle

Lindsay Kaye, vice president of threat intelligence at HUMAN Security, told The Next Web that demand is growing as fans seek cheaper ways to watch. The stolen credentials will outlast the tournament, posing ongoing risk to subscribers who reuse passwords across services. Italian police seized a piracy app in May 2026 that streamed Sky, DAZN, and Netflix through hijacked real accounts, showing that credential-based piracy is a growing enforcement problem beyond the World Cup.

With the final between Spain and Argentina expected to set another viewership record, the window for this black market is closing. But the credentials themselves will remain active for months or years, giving buyers continued access to streaming and other services tied to the same login information.