Cybersecurity for Sport and Events: Threats and Controls

Sport clubs, governing bodies and event organisers run business-critical operations on fixed dates in front of a global audience, which makes them easy to defraud, profitable to extort and attractive to disrupt. The UK NCSC found that 70% of sports organisations it surveyed had suffered at least one cyber incident or harmful activity in the previous year, more than double the rate for UK businesses generally. Venues add CCTV, turnstiles, payment systems and building controls to the usual office network, and major events draw state actors and hacktivists. This guide covers the sector threat picture from government sources, ticketing and data regulation, and the priority controls for clubs, federations, venues and event organisers. It is written for security and IT leads, venue technology managers and event operations teams.

Key takeaways

Business email compromise is the top threat. The NCSC called BEC the biggest cyber threat to the sector; transfer fees, sponsorship payments and supplier invoices are large and time-pressured.
Venues are systems of systems. CCTV, turnstiles, payment terminals and industrial control systems often share networks and third-party remote access with the office estate, so one compromise can close the gates.
Major events attract state actors. Olympic Destroyer, attributed in MITRE ATT&CK to Sandworm Team, was built to render systems inoperable at the 2018 Pyeongchang Winter Olympics.
Preparation works. ANSSI reported that despite ransomware, DDoS and an espionage intrusion around Paris 2024, none of the attacks had a notable impact on the running of the Games.
Fan and athlete data is high value. Ticketing platforms, membership schemes and athlete medical records carry payment, identity and special category data that attackers and insiders target.

The sector threat picture

The NCSC's report on the cyber threat to sports organisations, based on an Ipsos MORI survey of 57 organisations, remains the most detailed government study of the sector. Its figures show a sector that is heavily targeted and lightly defended.

Finding (NCSC survey, fieldwork 2019)	Figure	Why it matters
Organisations with at least one incident or harmful activity	70% (versus 32% across UK business)	The sector is a deliberate target, not a bystander
Incidents causing direct financial damage	About 30%; average above £10,000, largest single loss over £4m	Fraud is the main monetisation route
Received fraudulent emails, texts or calls	75%	Phishing and impersonation are constant
Attacks involving malware	About 40%, a quarter of them ransomware	Ransomware can stop match-day operations
MFA on some services	51%	Half the sector is exposed to simple credential theft
DMARC configured	Under a third	Club domains can be spoofed to fans and suppliers
CCTV, payment systems and turnstiles not on a segmented network	About 30%	Venue systems can be the route into the office, and the reverse
CCTV, payment systems and turnstiles remotely accessible by third parties	56%	Supplier access is a large, often unmanaged attack surface
Hold medical or performance data on players or athletes	77%	Special category data under data protection law

The survey is from 2019, so treat percentages as an indicator of the sector's habits rather than a current benchmark. The case examples in the report remain instructive: a Premier League club managing director entered credentials on a spoofed Office 365 page and criminals used the mailbox to try to divert a transfer payment of almost £1 million; an English Football League club refused a 400 bitcoin ransom after an attack took corporate email, CCTV and turnstiles offline because everything sat on one network.

Threats by adversary

Adversary	Typical objective	ATT&CK references
Fraud groups	Divert transfer fees, sponsorship and supplier payments; sell fake tickets	T1566 Phishing; T1114.003 Email Forwarding Rule; T1657 Financial Theft
Ransomware operators	Encrypt ticketing, venue and corporate systems around fixtures	T1486 Data Encrypted for Impact
Credential attackers and bots	Take over fan accounts and membership points, scalp tickets	T1110.004 Credential Stuffing; T1110.003 Password Spraying
Hacktivists	DDoS and defacement timed to high-profile events	T1498 Network Denial of Service; T1491.002 External Defacement
State actors	Disruption of mega-events, theft of anti-doping and athlete data	S0365 Olympic Destroyer; G0034 Sandworm Team; G0007 APT28

The NCSC report cites the 2016 breach of the World Anti-Doping Agency by Russian military intelligence, in which athlete medical files were stolen, as an example of state interest in sport. See the Hacktivism Guide for the DDoS-driven protest groups that cluster around major events.

Lessons from Paris 2024 and other major events

ANSSI, which led the cyber security component of the Paris 2024 Olympic and Paralympic Games, published one of the most useful public accounts of a mega-event threat picture in its Cyber Threat Overview 2024.

Volume: ANSSI handled 4,386 security events and 1,361 incidents in 2024, with activity rising from May to September and peaking in July. The organisers had expected eight to ten times the attack volume of Tokyo.
Ransomware around the edges: the Grand Palais RMN network was hit by BrainCipher in early August and Paris-Saclay University by WhiteRabbit. The French anti-doping laboratory hosted at the university kept operating, which ANSSI attributes to compartmentalised systems and rapid relief measures.
Hacktivism and false claims: pro-Russian and pro-Palestinian hacktivists ran DDoS attacks and published data-leak claims. ANSSI notes that such claims often overstate impact and take time to verify.
Cyber-physical attempts: an attempt to hijack advertising billboards to show hostile images was stopped quickly through joint action.
Espionage: a company hosting the Games was found to have been compromised by a suspected state actor since at least 2022, and the intrusion was detected before the Games began.

The transferable lessons for any event, from a league final to a marathon: map every organisation in the delivery chain, compartmentalise critical systems, monitor before the event as well as during it, and plan how to verify and communicate about hacktivist claims.

Regulation and legal obligations

Instrument	Who it affects	Security relevance
GDPR and UK GDPR	Clubs, federations and organisers processing fan, member, staff and athlete data	Article 32 security of processing. Health and performance data on athletes is special category data under Article 9 and needs tighter access control. See the GDPR Compliance Guide for Security Teams.
PCI DSS v4.0	Ticketing, hospitality, retail and stadium catering that accept cards	Scope the cardholder data environment across venue terminals and online shops; segment it from CCTV and building systems. See the PCI DSS 4.0 Guide.
US Better Online Ticket Sales (BOTS) Act	Ticket issuers and resellers for events at US venues seating more than 200	Prohibits circumventing a ticket issuer's security measures or access controls and selling tickets obtained that way, which gives legal weight to bot controls.
UK Digital Economy Act 2017 section 106 and the Breaching of Limits on Ticket Sales Regulations 2018	Buyers and resellers of tickets for recreational, sporting or cultural events in the UK	Creates an offence of using software or other means to obtain tickets above a purchase limit set in the conditions of sale.
NIS2 Directive	Sport is not a named NIS2 sector; venue operators, ticketing platforms or suppliers may fall in scope through other activities	Check each entity, especially digital service providers in the event supply chain. See the NIS2 Directive Guide.

Priority controls for clubs, federations and organisers

Email, payments and fraud

MFA everywhere, phishing-resistant for finance: the NCSC's own examples include a sporting body whose mailboxes ran a hidden forwarding rule for months across nine accounts, sending about 10,000 emails externally, because it had strong passwords but no MFA. Enforce MFA on all cloud mail and use security keys for finance, executives and player-transfer staff. See the Phishing-Resistant MFA Guide.
Mailbox rule monitoring: alert on new external forwarding and inbox rules that move or delete messages about payments.
Payment verification: any change to bank details for transfers, agents, sponsors or suppliers needs a call-back to a number held on file, never one in the email. See the Email Identity and BEC Guide and the Business Email Compromise Response Playbook.
Domain protection: publish SPF and DKIM and move DMARC to p=reject so fans and suppliers cannot be sent mail that appears to come from the club. See the DMARC, SPF and DKIM Guide.

Venue and stadium technology

Segment by function: separate zones for CCTV, access control and turnstiles, payment terminals, building management and industrial control, public Wi-Fi, broadcast and media, and corporate IT, with deny-by-default rules between them. See the Network Segmentation Guide.
Control supplier remote access: replace always-on vendor connections with brokered, time-limited, recorded sessions using individual named accounts. See the OT Remote Access Guide.
Separate accounts on venue systems: the NCSC found many organisations did not use separate user accounts on CCTV, payment and control systems. Remove default and shared logins. See the IoT Security Guide.
Patch out of season: plan firmware updates for turnstiles, cameras and controllers during close season or between events, with a tested fallback to manual entry.

Ticketing, fans and bots

Bot defence on high-demand releases: combine queueing, rate limiting, device and behaviour signals and purchase limits; the BOTS Act and UK regulations make circumvention unlawful but do not stop it. See the Bot Management Guide.
Fan account protection: detect credential stuffing on login and ticket-transfer endpoints, and offer passkeys or MFA for season ticket and membership accounts. See the Password Spraying and Credential Stuffing Defence Guide.
Third-party ticketing and CRM: require MFA and IP allow lists on every cloud data platform holding fan data. The Snowflake breach, in which Live Nation disclosed unauthorised activity in a third-party cloud database used by Ticketmaster, began with infostealer credentials on accounts without MFA.

Where identity fits: cloud keys and event-time accounts

Event operations create large numbers of short-lived accounts (stewards, volunteers, contractors, broadcasters, accreditation staff) and integration credentials (ticketing APIs, accreditation systems, results feeds, cloud storage for media assets).

Cloud keys in web code: the Football Australia AWS keys exposure involved access keys in the HTML of a public site that reached 127 storage buckets, including ticket buyer details and player contracts. Keep secrets out of front-end code, use temporary credentials and scan built web content. See the Git Secret Scanning Guide.
Event-time joiners and leavers: create temporary staff and volunteer accounts with a hard end date, least privilege on accreditation and ticketing tools, and automatic removal after the event.
Accreditation data: passport and identity details for athletes, staff and media are a valuable dataset; restrict exports and log bulk downloads.

Implementation roadmap

Twelve months out (or close season), assess: inventory venue systems, suppliers with remote access, ticketing and CRM platforms, and data on athletes and fans. Run an NCSC Exercise in a Box session (free micro and tabletop exercises including ransomware, phishing and supply chain) to find gaps.
Nine months out, identity and email: enforce MFA on mail and cloud platforms, security keys for finance and transfer staff, call-back payment verification, and DMARC enforcement. Pilot with finance first; keep a documented exception list and a break-glass account.
Six months out, venue segmentation: implement zones and firewall rules in monitor mode first, review logged flows with suppliers, then enforce. Keep a rollback rule set and test manual turnstile and payment fallbacks.
Three months out, event readiness: DDoS protection for ticketing and live sites, bot controls on releases, temporary account process, supplier contacts and escalation paths, and a joint exercise with venue, broadcaster, ticketing and police partners.
Event window: heightened monitoring, change freeze on venue and ticketing systems, a cyber lead in the event control room, and a prepared statement process for hacktivist claims.
After the event: remove temporary accounts and supplier access, rotate shared integration credentials, and run a post-event review.

Decision guidance: grassroots to mega-events

Decision	Community club or small federation	Professional club or venue	Major event organiser
Security operations	Use the provider's built-in security in cloud mail and managed IT support	Managed detection service covering mail, endpoints and venue network	Dedicated event SOC with national CERT liaison
Ticketing	Hosted ticketing provider with MFA on admin accounts	Provider with bot management and fan account protection	Contracted security requirements, joint testing, real-time fraud monitoring
Venue systems	Often owned by a landlord; agree responsibilities in writing	Segmented zones, brokered vendor access, asset inventory	Full OT and IoT security programme, supplier assurance, red teaming
Payments	Hosted payment pages to reduce PCI DSS scope	Segmented cardholder data environment across kiosks and retail	Payment partner assurance and incident coordination

Detection and measurement

Collect cloud mail sign-in and mailbox rule logs, ticketing and CRM admin logs, WAF and bot management telemetry, firewall logs between venue zones, remote access session records, and EDR on corporate and box office endpoints.

MFA coverage: share of mailboxes and cloud admin accounts with MFA, and of finance staff with phishing-resistant MFA.
Verified payment changes: percentage of bank detail changes confirmed by call-back before payment (target 100%).
Venue segmentation: number of permitted flows between venue zones and corporate IT, trending down.
Supplier access hygiene: vendor accounts with standing access versus brokered, time-limited access.
Bot pressure: share of ticket release traffic blocked or challenged, and fan account takeover reports per release.
Exercise outcomes: actions from tabletop exercises closed before the next major fixture.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
MFA and least privilege	PR.AA-05	IA-2, AC-6	Control 5, Control 6	5.15, 8.5
Venue network segmentation	PR.IR-01	SC-7	Control 12	8.20, 8.22
Supplier remote access and assurance	GV.SC-07	SA-9, SR-3	Control 15	5.19, 5.21
DDoS resilience for ticketing and live services	PR.IR-01	SC-5	Control 12	8.6
Monitoring and detection	DE.CM-01	SI-4	Control 8, Control 13	8.16
Incident response with event partners	RS.MA-01	IR-4	Control 17	5.24, 5.26
Recovery and continuity	RC.RP-01	CP-2	Control 11	5.30

Common failure patterns

Flat stadium networks: the NCSC's EFL club case lost email, CCTV and turnstiles together because every system shared one network.
Payment changes approved by email: transfer and supplier payments diverted after a mailbox takeover, as in the NCSC's Premier League example.
Cloud keys on the website: static keys in front-end code, as in the Football Australia AWS keys exposure, give anyone who views the page source access to fan and player data.
Single-factor access to fan data platforms: the Snowflake breach showed how infostealer credentials without MFA open a ticketing data warehouse.
Volunteer and contractor accounts that outlive the event: temporary access left active becomes a standing entry point.
Venue responsibilities unclear between club, landlord and suppliers: nobody patches the turnstiles because everyone assumes someone else does.

Lessons from incidents

Olympic Destroyer at Pyeongchang 2018 showed that a mega-event can face destructive, worm-like malware from a state actor. Paris 2024 showed the counterpoint: with compartmentalised systems, early detection and a coordinated national effort, ransomware, DDoS and espionage around the Games did not disrupt competition. At club level, the Football Australia AWS keys exposure is a reminder that the most damaging route can be a single static credential rather than a sophisticated attack.

Practitioner checklist

Enforce MFA on all mail and cloud platforms and issue security keys to finance, executives and transfer staff.
Require call-back verification for every change of bank details and alert on new mailbox forwarding rules.
Move the club or event domain to DMARC p=reject.
Segment CCTV, turnstiles, payments, building controls, public Wi-Fi and corporate IT, and test manual fallbacks.
Replace standing supplier remote access with brokered, time-limited, recorded sessions using named accounts.
Require MFA and network allow lists on ticketing, CRM and cloud data platforms holding fan data.
Scan websites and repositories for exposed keys and use temporary cloud credentials.
Give temporary event staff accounts with an automatic end date and remove supplier access after each event.
Run a joint exercise with venue, ticketing, broadcast and police partners before every major event.
Prepare a process to verify and respond to hacktivist data-leak claims.

Cybersecurity for Sport and Events Guide: Threats, Regulation and Priority Controls