Cybersecurity company Surfshark has released a new analysis of cybersecurity incidents targeting professional sports organisations and found a concerning trend: cyberattacks on sports teams increased by 112 percent over the past five years, with 2026 already registering three major breaches in its first quarter alone.
“Professional sports teams have transformed into a very attractive target for cybercriminals,” says Luís Costa, research and insights team lead at Surfshark. “What we’re seeing is no longer opportunistic hacking, it’s organised and strategic. The data these organisations hold, from player contracts and medical records to millions of fan payment details, is simply too valuable for attackers to ignore.”
Europe Is in the Lead
According to the study, Europe’s sports organisations are being attacked the most, representing 60 percent of all recorded incidents, followed by North America at 36 percent. Soccer is the most targeted sport, suffering 52 percent of all attacks across major leagues, including the Premier League, Serie A, and Ligue 1. Basketball is the second most affected sport, making up 20 percent of incidents.
Regarding incident type, ransomware has emerged as the “winner”, accounting for 41 percent of all attacks between 2021 and 2026. This represents a 250 percent increase from the previous five-year period, when ransomware was reported for just two incidents. According to data, these attacks have exposed hundreds of gigabytes of confidential information, including player contracts, NDAs, passports, and medical records.
Surfshark’s study also reveals that fans are also getting caught in the crossfire, with fan data compromised in 56 percent of all reported incidents. Early attacks, which focused on isolated e-commerce or ticketing scams, have evolved into massive database breaches exposing credit card details, addresses, and personal information. Social media accounts have also been weaponised, with hackers taking over official club accounts to promote cryptocurrency scams for sports fans, as seen in the FC Barcelona incident in October 2025.
Bad First-Quarter Results
The first quarter of 2026 has already set a troubling pace, with the scale of data breaches escalating significantly. Over 1.23 million records were compromised in just three major attacks this year, targeting Olympique de Marseille, AFC Ajax, and the French Rugby Federation.
“The escalation we’re seeing in 2026 is particularly alarming,” says Luís Costa. “The data suggests we could be heading towards a record-breaking year for sports-related cyberattacks.”
Costa explains that this surge is most likely a direct byproduct of the sports industry’s own innovation. As professional clubs accelerate their digital transformation to gain a competitive edge in player performance, scouting, and fan engagement, they simultaneously expand their attack surface. Cybercriminals now view the same data that gives teams an edge as a valuable asset to steal and exploit.
For the complete research material behind this study, click here.
Visit https://surfshark.com/
