Argentina Football Association Admits Hack After Victory Over Egypt: Fake Email Questions Referee Integrity in World Cup Match

Following Argentina's 1/8 finals victory over Egypt at the FIFA World Cup, the Argentine Football Association (AFA) suffered a significant cyber intrusion that allowed hackers to send a forged email from an official AFA Medios account to accredited journalists. The message accused French referee Francois Letexier of biased officiating in favor of Argentina, lavishly praised the Egyptian team's performance, and included threatening language tied to the Middle East conflict. AFA quickly denied authorizing the message and confirmed unauthorized access to internal systems, including parts of its database containing emails, passwords, and IP addresses that may now be sold on dark web forums. The fabricated claims closely mirrored public criticisms voiced by Egyptian coach Hossam Hassan and player Mostafa Zico after their elimination. AFA has launched a full investigation to assess the breach's scope and improve security, while advising affected users to change passwords immediately. Argentina, meanwhile, continues preparations for its quarterfinal clash against Switzerland.

securitylab_nJuly 14, 2026Translated from Russian

Read at source

Argentina's victory over Egypt in the round of 16 at the FIFA World Cup has been overshadowed by a major cybersecurity scandal involving the Argentine Football Association (AFA). Shortly after the match, an unauthorized email was distributed from an account linked to AFA Medios, the organization's official media channel, reaching several accredited journalists.

The forged message directly challenged the legitimacy of Argentina's win, claiming it resulted from biased refereeing by French official Francois Letexier. It praised the Egyptian side in glowing terms and incorporated threatening language referencing the ongoing conflict in the Middle East.

AFA immediately distanced itself from the email, stating that it was not sent by its press service and had not been approved by the organization's leadership. Representatives confirmed that the distribution was made possible only through unauthorized access to the federation's internal systems.

According to sources within the organization, the intrusion is believed to have been carried out by a group of hackers, likely based in Egypt. The attackers gained access to a portion of the AFA database, obtaining email addresses, passwords, and IP addresses of users. These credentials may subsequently have been offered for sale on specialized underground forums.

The content of the fake email closely echoed earlier public statements made by Egyptian national team coach Hossam Hassan and player Mostafa Zico, who had criticized the refereeing after their team's elimination. However, video reviews of key incidents in the match found no evidence of deliberate decisions by the referee that favored Argentina.

AFA has announced a comprehensive investigation to determine the full scale of the data breach, identify how the attackers obtained access, and implement stronger protective measures for its systems and user information.

Individuals whose data may have been compromised are strongly advised to change passwords for any linked accounts and to exercise caution when receiving suspicious emails purporting to come from the federation. The Argentine national team is now focusing on its upcoming quarterfinal match against Switzerland.

Argentina Football Association AFA Medios FIFA World Cup Francois Letexier Hossam Hassan Mostafa Zico

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese

Data Breaches & Leaks

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

BoletimSecOct 20, 2026Translated from Portuguese