Iran-Linked Hacker Group Claims FBI Drone Breach, Threatens World Cup Security An Iran-affiliated hacker group, Handala, has claimed responsibility for breaching FBI-operated drones, alleging access to surveillance footage, facial recognition data, and license plate scans used for counterterrorism. The group, monitored by the SITE Intelligence Group, stated it had infiltrated the drones "for months," capturing "every image and every suspect" from first-person view (FPV) drones deployed by the FBI. In a statement released Friday, Handala issued a veiled threat against the 2026 FIFA World Cup, which began Thursday, warning that "FPVs are everywhere" and could pose risks to teams and events. The FBI is using drones to secure World Cup venues, with flights banned over stadiums and fan zones to prevent unauthorized aircraft. The U.S. Justice Department had previously warned of potential cyber retaliation from Iranian actors following U.S.-Israeli strikes on Tehran in February, which escalated regional tensions. Handala has a history of cyber operations, including a March claim of hacking the email account of an FBI official and leaking personal photos. While Handala provided alleged evidence of the drone breach, SITE disputed the authenticity of the footage, identifying one video as promotional material from a U.S. police department’s 2024 tornado response demonstration. The U.S. State Department has offered a $10 million reward for information leading to the identification of the group’s members.

Cybersecurity Risks at Major Global Sporting Events: Lessons from Milan Cortina 2026 and Beyond High-profile international sporting events like the Milan Cortina 2026 Winter Olympics and the 2026 FIFA World Cup have become prime targets for cyber threats, driven by geopolitical tensions, hacktivism, and financially motivated cybercrime. These events attract billions of viewers and involve complex logistics, creating a broad attack surface for adversaries seeking disruption, financial gain, or political statements. ### Key Threats and Recent Incidents - Geopolitical Tensions: The Ukraine war has intensified cyber threats, with Russia-linked hacktivist groups like NoName057 targeting critical infrastructure in Europe. Italian authorities reported thwarting Russia-associated cyberattacks on Olympic-related websites, hotels, and venues in early 2026. - DDoS Surge: Italy experienced a 180% spike in DDoS attacks during the Winter Games, according to Netscope, highlighting the scale of disruption attempts. - Historical Precedents: Past events, such as the 2018 Pyeongchang Olympics, faced Olympic Destroyer malware, which disrupted Wi-Fi, ticketing, and broadcast systems. The 2012 London Olympics narrowly avoided a power grid attack, underscoring the persistent threat to critical infrastructure. ### Security Efforts and Coordination - CISA’s Role: The Cybersecurity and Infrastructure Security Agency (CISA) collaborated with the U.S. Department of State’s Diplomatic Security Service and international partners to monitor real-time threats during the Winter Games. These efforts are part of broader preparations for FIFA World Cup 2026, America 250, and the 2028 Summer Olympics. - Third-Party Risks: Events rely on vendors, sponsors, and streaming services, expanding the attack surface. A single weak link such as a compromised ticketing agency can lead to cascading disruptions. - Incident Response Lessons: Successful mitigation requires layered defenses, well-tested playbooks, and cross-agency coordination. Organizations must prepare for phishing, ransomware, credential harvesting, and supply chain attacks, which mirror threats faced by businesses but on a larger scale. ### Broader Implications for Businesses - Executive Targeting: High-profile attendees including corporate leaders face risks like device compromise, identity theft, and social engineering, which could grant attackers access to sensitive data. - Reputation Management: Rapid, transparent communication during an incident is critical to maintaining trust with stakeholders, regulators, and the public. - Continuous Testing: Regular tabletop exercises, red/blue team drills, and simulations ensure teams can respond effectively under pressure. As global events grow in scale, so do the cyber risks. The lessons from Milan Cortina 2026 and past incidents demonstrate the need for proactive security measures, cross-sector collaboration, and resilient incident response strategies both for event organizers and the businesses that engage with them.