Cyber Attack on Argentine Football Association
Details of the cyber attack sparked by World Cup frustration
1Background of the Attack
The cyber attack on the Argentine Football Association (AFA) may have been fueled by frustration over Egypt's elimination in the World Cup. Egypt's coach and federation complained about referee and VAR decisions during the match. The attack was discovered after mass emails were sent from AFA's systems.
2Infostealer Infection
Hudson Rock detected an infostealer infection on a device belonging to an AFA software developer, dating back to September 2025. This device provided attackers with access to the federation's systems. The attackers either waited nearly a year to use this access or activated it after Egypt's controversial elimination.
3Deep System Access
After logging into AFA's systems with stolen credentials, the attackers gained extensive administrative control. This included access to phpMyAdmin panels, root access to certain databases, and the federation's media portal. Weak and reused passwords facilitated the attack.
4Data Put Up for Sale
The attackers offered stolen AFA data for sale on cybercrime forums. The data included details about staff, professional clubs, and media partners. Sensitive information such as email addresses, phone numbers, and user roles were also leaked.
5Security Vulnerabilities
Hudson Rock highlighted security shortcomings at AFA. Some passwords were stored in plaintext, marking a significant vulnerability. Attackers exploited these weaknesses to maintain access to the federation's systems for an extended period.
6Outcome and Measures
AFA announced it is investigating the attack and implementing necessary security measures. This incident serves as a textbook example of how devastating a single infostealer infection can be. The federation is now focused on strengthening its systems to prevent future attacks.