THE NEW ARENA: HOW CYBER THREATS ARE TARGETING U.S. PROFESSIONAL SPORTS IN 2025

2 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Executive Summary The world of professional sports has always been a high-stakes arena, defined by competition, spectacle, and billion-dollar industries built on fan loyalty. But in 2025, the most consequential battles are increasingly happening far from the field. Sports organizations today are not just athletic teams, they are global technology enterprises, fintech operators, media platforms, and data-driven businesses. They manage enormous volumes of sensitive data, run sophisticated digital infrastructure, process millions of online transactions, and engage with fans across platforms that span the globe. With that transformation has come a dramatic expansion of their cyberattack surface, and adversaries have noticed.

The last 18 months have seen a clear escalation in the scale and sophistication of cyber threats targeting U.S. professional sports. Ransomware gangs time their operations around playoff seasons and marquee events to maximize leverage. Sophisticated business email compromise (BEC) campaigns exploit the high-velocity financial transactions inherent to sports. Deepfake impersonation and AI-generated scams are proliferating, exploiting the public trust in players, executives, and team brands. Fraudsters are exploiting ticket demand and merchandise sales, while payment skimming operations quietly siphon financial data from e-commerce platforms. Even official social media accounts, once considered peripheral, are being hijacked to distribute scams and misinformation.

This report presents an in-depth analysis of the evolving threat landscape in professional sports. Each section explores a major category of cyber risk, explains the underlying mechanics of the threat, and highlights real incidents from 2024 and 2025 that demonstrate how adversaries operate in this sector. The message is clear: cybercrime has become as central to the business of sports as ticket sales, sponsorships, and game-day operations. Winning in this new arena requires the same preparation, intelligence, and discipline that teams bring to the field.

3 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Introduction: The Digital Transformation of Sports Professional sports organizations have undergone one of the most profound digital transformations of any industry. What was once a business built on physical events, paper tickets, and televised broadcasts is now a fully digital ecosystem. Stadiums are complex, connected environments integrating IoT devices, building automation, access control, and surveillance systems. Ticketing, concessions, and fan engagement are handled through digital platforms and mobile apps. Wearable devices and analytics platforms capture terabytes of player data and distribute it through cloud-based systems to coaching and medical teams. Sponsorship activations, fan interactions, and merchandising are orchestrated across social media, e-commerce, and augmented reality platforms.

This transformation has created immense opportunity, but it has also multiplied the number of entry points available to attackers. Every digital touchpoint, from a ticketing API to a payment processor, represents a potential vulnerability. Every vendor relationship adds another link to the supply chain that could be compromised. Every fan interaction becomes a potential phishing lure. And every byte of data collected, from biometric profiles to financial transactions, becomes a target for theft, extortion, or manipulation.

The result is a sector uniquely exposed to cyber risk. It combines high-value targets (from VIP data to financial flows) with immovable timelines (seasons, playoffs, and live events) and intense public visibility. That combination is irresistible to cybercriminals, who now view sports organizations as lucrative, high-profile targets.

Supply Chain / Third Party

Ransomware / Extortion

Payment Skimming / E-Commerce

Ticket Fraud / Counterfeits

Phishing / BEC

DDoS / Disruption

Impersonations (Social Media, Merchandise)

Fake Broadcasting

Share of Reported Incidents Targeting Sports Teams

4 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Quantifying Cyber Risk in Professional Sports Cyberattacks against the global sports industry have accelerated at a pace unmatched by most other sectors. Over the last decade, recorded cyber incidents targeting sports organizations have grown more than twentyfold, with the steepest rise occurring after 2020 as leagues embraced cloud infrastructure, digital ticketing, and remote broadcast operations. Check Point data and other third-party research show that global attack volumes continue to rise at an average of 30 percent year over year, with ransomware and phishing campaigns driving much of that growth.

Notable Attack Vectors Recent surveys indicate that roughly 70 percent of sports organizations worldwide report at least one successful cyber incident each year, compared with 60 percent in healthcare and less than 50 percent in the financial sector. In the United States, the concentration of high-value teams and fan-facing platforms makes that figure likely even higher. This frequency underscores how sports have become one of the most attractive modern attack surfaces. It is a combination of valuable data, immovable timelines, and mass public exposure.

In terms of attack composition, phishing and business email compromise (BEC) remain the dominant vectors, accounting for roughly 30-35% of all reported incidents in the past year. Ransomware and data extortion campaigns make up another 20-25%, frequently targeting media infrastructure, vendor networks, and player-data repositories. Supply chain compromises contribute around 15%, often through third-party software or e-commerce integrations. The remaining categories include payment skimming and counterfeit commerce, ticket fraud and resale scams, and DDoS or broadcast disruption attacks, fake broadcasting services and distribution or selling of counterfeit merchandise. This distribution reflects a simple truth: the sports industry’s digital dependencies are now as complex as those of any Fortune 500 company. Each broadcast feed, payment portal, or analytics platform represents a potential attack vector, and adversaries exploit that diversity to maximize leverage.

Source: Survey data from Check Point Exposure Risk Management

2022

Campaigns Using AI / Deepfakes

0

50

100

150

200

2023 2024 2025

Ca mp

aig ns

5 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Human Factors Human factors remain a defining weakness. An estimated 67 percent of successful intrusions involve the human element, such as phishing emails, credential reuse, or inadvertent data sharing. Technical vulnerabilities account for the remaining one-third, including misconfigured cloud environments and unpatched software. This human-to-technical ratio is consistent with global findings across multiple industries but carries unique consequences in sports, where the boundary between staff, athletes, and external contractors is often blurred.

Artificial Intelligence The rise of artificial intelligence has added yet another dimension. The share of malicious campaigns against sports teams in the US using AI-generated content, deepfake videos, or synthetic social engineering material has grown from about 10 percent in 2022 to more than 70 percent in 2025, amplifying both scale and believability. These technologies allow attackers to replicate voices, generate authentic-looking sponsorships, and conduct mass impersonation at minimal cost.

Source: Survey data from Check Point Exposure Risk Management

Financial Impact to Sports Teams by Threat Category

Ticket and Counterfeit Fraud

Social Media Account Hijacking

Payment Skimming and E-Commerce Breaches

Fake Broadcasting Services / Illegal Streams

DDoS and Broadcast Disruption

Fake Merchandise and Counterfeit Commerce

AI-Driven Impersonation / Exploitation

Business Email Compromise (BEC) / Phishing Fraud

Supply Chain Compromise

Ransomware / Data Extortion

0

Direct Loss Total Impact

USD (Millions)

2 4 6 8 10 12 14

Ticket and Counterfeit Fraud

Social Media Account Hijacking

Payment Skimming and E-Commerce Breaches

Fake Broadcasting Services / Illegal Streams

DDoS and Broadcast Disruption

Fake Merchandise and Counterfeit Commerce

AI-Driven Impersonation / Exploitation

Business Email Compromise (BEC) / Phishing Fraud

Supply Chain Compromise

Ransomware / Data Extortion

0

Direct Loss Total Impact

USD (Millions)

2 4 6 8 10 12 14

6 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

The Dollar Value of Cyber Risks Financially, the damage is equally striking. Check Point’s modeling and open-source data estimate that the average ransomware incident in the sports sector costs between 4 and 5 million USD, not including reputational losses or regulatory fines. Phishing and BEC fraud average around 1.5 to 2 million USD per incident, while payment skimming or counterfeit commerce breaches typically result in hundreds of thousands of dollars in direct losses. Even small-scale ticketing scams can inflict cumulative damages in the millions when combined with chargebacks and consumer remediation costs.

The economics of cybercrime in sports now mirror those of traditional financial crime. Attackers understand that the visibility and time sensitivity of major sporting events multiply their leverage. A disrupted broadcast, breached ticketing system, or leaked contract negotiation can have an immediate commercial impact.

This convergence of financial motive, digital complexity, and public exposure defines the modern threat environment for professional sports. The following sections explore each of these vectors in detail, including ransomware, supply chain compromise, phishing, AI-based impersonation, and fraudulent commerce, and illustrate how they manifest across the American sports landscape today.

Source: Survey data from Check Point Exposure Risk Management

7 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

The Modern Threat Landscape in Professional Sports The following section examines the primary attack vectors shaping the cybersecurity risks faced by professional sports organizations today. Each vector represents a distinct mode of compromise, from ransomware and phishing to supply chain breaches, counterfeit commerce, and deepfake-driven de- ception. For each, we explain how the threat operates, its potential impact on teams, leagues, partners, and fans, and present a recent real-world example that illustrates the tactics, scale, and consequences of the attack. This approach connects the data-driven trends described above with the tangible realities confronting the sports industry in 2025.

Ransomware and Data Extortion Ransomware remains one of the most disruptive and financially damaging threats facing the sports industry. At a technical level, these attacks often begin with credential theft, phishing, or exploitation of unpatched vulnerabilities, which provide attackers with initial access. Once inside the network, adversaries use tactics like privilege escalation, lateral movement, and reconnaissance to identify critical systems. They then exfiltrate sensitive data, often including personal information, contracts, financial records, and internal communications, before deploying encryption across key assets. This “double extortion” model ensures that even if victims restore systems from backups, the threat of public data leaks still looms.

Timing is a crucial element of ransomware operations against sports organizations. Attackers deliberately schedule intrusions to coincide with critical moments such as season openers, playoff runs, or high-profile sponsorship launches. The immovable nature of sports schedules magnifies the pressure on victims to pay.

One of the most notable examples occurred in March 2025, when the Medusa ransomware group targeted NASCAR. Attackers infiltrated its network, exfiltrated over a terabyte of sensitive data, and then encrypted key systems. They demanded a four-million-dollar ransom and began releasing stolen files online to escalate pressure. The timing, just weeks before the new racing season, significantly increased the impact. NASCAR was forced to mobilize emergency response teams, notify affected individuals, and work closely with law enforcement, all while preparing for the start of competition. This case illustrates the high-stakes nature of ransomware in sports: the operational, financial, and reputational consequences are amplified by the sector’s time-sensitive nature.

8 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Supply Chain and Vendor Compromise Sports organizations rely heavily on third parties for core operations, from ticketing and concessions to analytics, marketing, and security. Each partnership introduces potential vulnerabilities, particularly when vendors have privileged access or process sensitive data. Attackers increasingly exploit these relationships, recognizing that a supplier with weaker security controls can serve as a backdoor into a larger target.

Supply chain attacks often unfold in two stages. First, adversaries compromise a vendor through phishing, credential stuffing, or exploitation of vulnerabilities in their systems. Once inside, they leverage existing integrations, API connections, or trusted network pathways to pivot into the primary target’s environment. Because these connections are often considered trusted, traditional security controls may not flag malicious activity.

The 2024–2025 compromise of the Green Bay Packers’ online Pro Shop demonstrates how devastating these attacks can be. Attackers exploited vulnerabilities in the third-party e-commerce platform managing the team’s store and injected a malicious script into the checkout page. Over a two-month period, the script harvested customer names, addresses, and full payment card data, including CVV codes. The breach went undetected until January 2025, by which time the stolen data had already appeared on dark web marketplaces. This incident underscores the critical importance of continuous vendor risk monitoring and strict access controls, particularly for platforms handling fan data and payments.

Phishing and Business Email Compromise (BEC) Phishing and BEC attacks remain among the most effective methods adversaries use to breach sports organizations. These campaigns exploit the high tempo of business operations where large financial transactions, urgent communications, and sensitive negotiations occur daily, in order to manipulate human trust. At a technical level, attackers often create convincing replicas of login portals to harvest credentials, or craft carefully targeted emails impersonating executives, agents, or vendors. More advanced campaigns incorporate compromised accounts, allowing attackers to send messages from legitimate email addresses and bypass basic security controls.

Business email compromise is especially dangerous in the sports industry due to the complexity of financial workflows. Teams regularly execute high-value transactions involving player contracts, sponsorship deals, travel logistics, and vendor payments. Even a single fraudulent payment authorization can result in millions of dollars in losses.

9 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

A major incident in early 2025 highlighted the scale of this risk. Several NBA franchise partners were targeted by a sophisticated spear-phishing campaign during the trade window. Attackers impersonated senior executives and sent urgent payment instructions tied to sponsorship agreements and player transactions. In multiple cases, stolen credentials from compromised accounts were used to send follow-up emails, increasing the legitimacy of the requests. Funds were successfully redirected to accounts controlled by criminal groups before the fraud was detected. This campaign illustrates how attackers use insider knowledge of league schedules and operational cycles to increase the success rate of BEC attacks.

The problem extends beyond North American leagues. In our analysis “Playing Offside: How Threat Actors Are Warming Up for FIFA 2026,” Check Point documented how phishing campaigns are already targeting World Cup-related systems. Adversaries are spoofing ticketing platforms, fan engagement apps, and official communications to steal credentials and payment data. These attacks, often launched months or even years ahead of major events, show how deeply integrated social engineering operations have become in the sports cybercrime ecosystem.

AI-Driven Impersonation and Deepfake Exploitation The rise of generative artificial intelligence has fundamentally changed how impersonation and fraud campaigns operate. Modern threat actors now use deep learning models to produce highly realistic synthetic media, including videos, audio clips, and still images, that convincingly mimic the appearance and voice of athletes, executives, and sponsors. These falsified materials are used in a wide range of malicious activity such as promoting fake investments, manipulating digital markets, creating fabricated sponsorships, or enticing fans into fraudulent giveaways and merchandise schemes.

For sports organizations, the stakes are particularly high because of the immense public trust their players command. Athletes are instantly recognizable, and fans are naturally inclined to believe a message or video that appears to come directly from them. That emotional connection gives adversaries an unusually effective social engineering tool: the ability to exploit fame and authenticity itself.

A striking example appeared in mid-2025 when criminals launched a series of cryptocurrency scams centered on a fake “CR7” coin. Deepfake videos and synthetic social media posts showed what appeared to be Cristiano Ronaldo personally endorsing the new token and promising exclusive fan rewards. None of it was real. The campaign used AI-generated likenesses and voice models of the player to create promotional videos that circulated widely across TikTok, YouTube, and Telegram. Within hours, several fraudulent coins using Ronaldo’s name appeared on the Solana network, one briefly reaching a valuation of more than 140 million USD before collapsing in a classic “rug pull.”

10 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

The incident demonstrated how deepfakes and synthetic personas can amplify financial fraud at unprecedented scale. Attackers combined realistic AI-generated endorsements with the viral speed of social media to attract thousands of victims before the scam unraveled. For the sports industry, the case underscores the urgent need to authenticate official content, monitor for unauthorized use of player likeness, and coordinate rapid takedowns when impersonation campaigns emerge. Beyond the direct monetary losses, such attacks threaten long-term reputational harm and legal exposure for both athletes and their affiliated organizations.

Ticket Fraud and Counterfeit Commerce Few areas of professional sports are as vulnerable to cyber-enabled crime as ticketing. The convergence of high demand, digital distribution, secondary resale markets, and peer-to-peer payment platforms has created an environment where fraud can scale rapidly and invisibly. Attackers employ multiple tactics, including creating fake websites that mimic legitimate ticketing portals, duplicating authentic digital tickets for resale, and compromising existing accounts to divert legitimate inventory. Many scams are supported by social engineering campaigns designed to create a sense of urgency, such as offers tied to playoff games or exclusive VIP experiences, prompting victims to act before verifying legitimacy.

These attacks often go beyond simple consumer fraud. Sophisticated criminal groups use ticketing scams to harvest personal and financial data, which is then monetized through identity theft, credential stuffing, or resale on the dark web. Others use compromised ticket accounts as entry points into broader organizational systems, particularly when those accounts are linked to corporate hospitality or partner portals.

A major example occurred in January 2025, when prosecutors in New York charged a criminal network with stealing over 600,000 dollars worth of digital tickets from compromised StubHub accounts. The group targeted high-profile events including NBA games and the U.S. Open, reselling the stolen tickets through fraudulent marketplaces and peer-to-peer payment platforms. Victims often only discovered the fraud when denied entry at venues. In parallel, law enforcement seized nearly 40 million dollars in counterfeit merchandise ahead of Super Bowl LIX, highlighting how ticketing scams often intersect with broader criminal ecosystems involving counterfeiting, money laundering, and identity theft.

11 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

The implications for sports organizations extend far beyond individual fans. Large-scale fraud undermines confidence in official ticketing channels, complicates relationships with sponsors and partners, and can lead to regulatory scrutiny if consumer protection laws are violated. It also has a direct financial impact, as refunds, chargebacks, and brand damage erode revenue.

Payment Skimming and E-Commerce Attacks E-commerce is now central to the fan experience, from merchandise sales and digital collectibles to premium hospitality bookings. But these platforms are also prime targets for cybercriminals, particularly during high-traffic periods like playoffs, championship runs, and product launches. Attackers often deploy payment skimming techniques, malicious JavaScript code injected into checkout pages, to capture payment card data in real time. This method, often referred to as “Magecart,” exploits vulnerabilities in third-party plugins, content delivery networks, or unmonitored portions of the supply chain.

These attacks are particularly difficult to detect. Because the malicious scripts mimic normal site functionality and operate client-side, they often evade traditional security controls and monitoring tools. By the time they are discovered, thousands of transactions may have been compromised, with stolen card data already monetized or sold.

The 2024–2025 breach of the Green Bay Packers’ online store is a textbook example. Attackers inserted a skimming script into the checkout page, harvesting sensitive payment information from more than 8,500 customers over several weeks. The breach was not detected until January 2025, and by then, the stolen data had appeared in multiple criminal forums. The incident demonstrates how attackers exploit e-commerce complexity to operate stealthily and highlights the need for more advanced runtime monitoring, supply chain security validation, and regular code integrity checks.

Beyond direct financial losses, these attacks erode fan trust, a critical intangible asset in the sports industry. Once fans associate a team’s online store with financial theft, even a rapid response may not fully repair reputational damage.

12 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Distributed Denial-of-Service (DDoS) and Broadcast Disruption Live sports are among the most time-sensitive digital services in the world, and adversaries exploit this by launching distributed denial-of-service (DDoS) attacks that overwhelm networks and render them unavailable. These attacks typically flood websites, APIs, or broadcast infrastructure with massive amounts of traffic, preventing legitimate users from accessing services. DDoS campaigns are often timed to coincide with key events, including playoff games, ticket sales windows, or in-game betting sessions, when the financial and reputational stakes are highest.

Attackers use DDoS for various motives. Some launch attacks as part of extortion schemes, threatening continued disruption unless payment is made. Others use them as smokescreens to distract security teams while more targeted intrusions are underway. Hacktivist groups and politically motivated actors have also used DDoS attacks to draw attention to causes during high-profile sporting events.

A significant example occurred during EURO 2024, when Poland’s state broadcaster was targeted by a DDoS attack that disrupted streaming for critical matches against the Netherlands and Austria. Millions of viewers were affected, and the incident sparked widespread criticism of the broadcaster’s preparedness. Around the same time, authorities dismantled StreamEast, a major piracy network with over 1.6 billion visits in 2024. The platform was not only a hub for illegal streaming but also a launchpad for additional cybercriminal activity, including credential theft and DDoS operations.

For U.S. sports organizations, the lesson is clear: any disruption to digital services, whether streaming, mobile ticketing, or betting, has immediate revenue consequences and long-term reputational implications. Ensuring DDoS resilience through scalable cloud infrastructure, traffic filtering, and layered defense is now a fundamental business requirement.

Social Media Account Hijacking Social media has become one of the most powerful tools for sports organizations to engage with fans, announce news, and manage their brands. But it is also a prime target for cybercriminals. Account takeovers typically occur through credential theft, phishing, or exploitation of weak authentication controls. Once attackers gain access, they can instantly broadcast scams, malware, or disinformation to millions of followers, leveraging the trust and authority of the official account.

The risks of such attacks are multifaceted. Beyond the immediate reputational damage, compromised accounts can be used to distribute phishing links, harvest credentials, or redirect users to malicious sites. They can also serve as part of larger fraud campaigns, such as promoting fake NFT drops, fraudulent giveaways, or cryptocurrency scams.

13 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

In March 2025, several NBA teams and NASCAR experienced account takeovers on X (formerly Twitter). The compromised accounts were used to promote fraudulent cryptocurrency schemes and redirect followers to malicious websites. Although the accounts were recovered quickly, the incidents reached millions of fans and generated significant negative press. They also highlighted the ease with which attackers can exploit third-party social media management tools, session tokens, or weak authentication to gain control of high-value accounts.

The consequences of social media compromise extend beyond financial fraud. A coordinated campaign targeting team accounts could be used to spread disinformation about player transactions, ticket sales, or public safety, creating confusion and potentially influencing markets, attendance, or even game outcomes.

Fake Broadcasting Services As the streaming economy has reshaped sports consumption, cybercriminals have turned unauthorized broadcasts into one of their most effective methods for fraud and data theft. Fake streaming services typically appear as pop-up websites or social media advertisements promising free or discounted access to live games. Once fans click the link, they are directed to phishing pages that request credit card details, email logins, or streaming “subscriptions.” Some sites even prompt users to install browser extensions or software that secretly deploys malware or steals session tokens.

The psychological trigger behind these attacks is urgency. Fans are desperate to find a working stream before kickoff, and the social nature of these scams, often promoted through Facebook, X, or Reddit, creates a sense of authenticity. Attackers exploit this trust by rapidly spinning up fake domains, using team logos and broadcast graphics that appear legitimate.

14 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Check Point threat intelligence data shows that, on average, over 1,200 fraudulent sports-streaming domains are detected and blocked each month during major U.S. sports seasons. Many of these domains are supported by extensive social media amplification networks, including fake pages, influencer accounts, and coordinated hashtag campaigns. The goal is not only to attract fans looking for a “free stream,” but also to harvest payment information, login credentials, or install tracking scripts that can later be used in broader fraud operations.

For professional leagues and broadcasters, fake streaming services represent a multi-layered threat. Beyond the direct harm to fans, these operations erode trust in legitimate streaming platforms and can compromise personal data at scale. They also undermine broadcast rights, which are core revenue drivers for the NFL, NBA, and MLB. Combatting this threat requires close coordination between leagues, cybersecurity vendors, and social platforms to identify and remove fraudulent domains before game day.

Fake Merchandise and Counterfeit Commerce Counterfeit sports merchandise remains one of the most persistent and damaging forms of cyber- enabled fraud. As e-commerce becomes the dominant sales channel for jerseys, collectibles, and memorabilia, counterfeiters have adopted increasingly sophisticated digital tactics. They create fake websites that mirror official team stores, manipulate search engine ads, and flood social media with cloned product listings. Many of these operations are connected to organized criminal networks that move counterfeit goods through international logistics routes and online payment systems.

Technically, these schemes often combine traditional counterfeiting with cybercrime. Attackers hijack legitimate marketplace accounts, inject malicious advertising scripts into search results, or operate entire fake storefronts that accept online payments but never deliver products. In other cases, they use stolen images and videos from official retailers to lend authenticity to scam listings. The criminal infrastructure supporting these operations frequently overlaps with broader online fraud ecosystems, including identity theft and money laundering.

15 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

A prominent example occurred in early 2025, when U.S. Immigration and Customs Enforcement (ICE) announced the results of “Operation Team Player,” a nationwide enforcement action carried out with the National Football League ahead of Super Bowl LIX. Investigators seized more than 39 million USD worth of counterfeit jerseys, hats, and memorabilia in 85 separate shipments intercepted at ports and distribution hubs. The seized goods, which imitated merchandise from nearly every major U.S. sports league, were traced to manufacturing networks in China and shipped through intermediaries posing as legitimate sellers on major e-commerce platforms.

For teams and leagues, counterfeit merchandise poses more than a financial risk. It undermines licensing revenue, damages brand integrity, and creates potential safety hazards when counterfeit apparel fails to meet material standards. The 2025 seizures also revealed how counterfeit supply chains intersect with online payment fraud and identity theft, since many consumers who purchased fake items also reported unauthorized charges or phishing attempts following their transactions. Addressing this issue requires proactive brand protection programs, digital monitoring for infringing domains, and cooperation with law enforcement to dismantle international counterfeit networks before they reach consumers.

Global Lessons for U.S. Sports The cyber threats facing U.S. sports organizations are part of a global trend, and international events often serve as test beds for new attack techniques. The 2024 Paris Olympics provided a case study in large-scale cyber operations targeting a sporting event. Threat actors launched sophisticated phishing campaigns impersonating the International Olympic Committee and event partners, distributed counterfeit credentials and work permits on dark web marketplaces, and deployed deepfake disinformation campaigns designed to undermine confidence in event security. These attacks targeted not just the organizing committee but also athletes, sponsors, vendors, and media organizations.

These global campaigns reveal how adversaries adapt their tactics around major events. They exploit heightened public interest, widespread online engagement, and complex supply chains to maximize impact. The lessons are directly applicable to U.S. leagues and teams. As the 2026 FIFA World Cup approaches, with the U.S. set to host the largest portion of matches, organizations should expect similar tactics aimed at ticketing systems, sponsorship networks, broadcast infrastructure, and fan engagement platforms.

16 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Building a Proactive Defense The evolving threat landscape demands a proactive, intelligence-driven approach to cybersecurity.

Sports organizations must adopt strategies that go beyond perimeter defense and focus on resilience, visibility, and rapid response.

Implement Zero Trust Architecture Access decisions should be based on identity, device posture, and context rather than network location. Multi-factor authentication should be mandatory for all users, and

privileged access should be tightly controlled and continuously monitored.

Secure the Supply Chain Vendor relationships should be governed by strict security requirements, including breach notification clauses, minimum encryption standards, and regular security

audits. Continuous monitoring of third-party integrations is essential, particularly for platforms handling payments, personal data, or operational systems.

Enhance Detection and Response Capabilities Security teams should have robust monitoring for lateral movement, data exfiltration,

and abnormal network activity. Incident response plans must account for the time-sensitive nature of sports operations and include clearly defined escalation paths,

communication strategies, and legal protocols.

Invest in Threat Intelligence External visibility into dark web marketplaces, phishing infrastructure, domain

impersonation, and emerging malware campaigns is critical. Intelligence sharing with law enforcement, industry peers, and government agencies can help identify threats

before they materialize.

Protect Digital Engagement Channels Social media accounts should be secured with hardware-based multi-factor

authentication and monitored for anomalous activity. E-commerce platforms should implement strong content security policies, real-time code integrity monitoring,

and regular penetration testing.

Educate and Engage Fans Fans are often the first line of defense. Teams should run awareness campaigns on how to purchase tickets safely, recognize phishing attempts, and verify official communications. Clear communication during incidents can prevent the spread

of misinformation and limit damage.

17 THE NE W ARENA:

HOW CYBER THRE ATS ARE TARGE T ING U.S. PROFESSIONAL SPORTS IN 2025

Conclusion The professional sports industry has entered a new era, one in which the outcome of a season may hinge as much on cybersecurity preparedness as on athletic performance. Adversaries are exploiting every aspect of the modern sports business: ransomware that paralyzes operations, phishing campaigns that divert millions, deepfakes that weaponize public trust, and fraud schemes that exploit fan passion. They are targeting teams, leagues, vendors, and fans alike, driven by financial gain, geopolitical motives, or simple disruption.

The examples from 2024 and 2025 make one thing clear: this is no longer a theoretical risk. The question is not whether a sports organization will be targeted but how prepared it will be when the inevitable happens. The teams that succeed in this new environment will be those that treat cybersecurity as a core business function, one that is woven into every layer of operations, from ticketing and merchandising to data analytics and fan engagement.

Winning in this new arena requires the same principles that define success on the field: preparation, intelligence, discipline, and adaptability. With the right strategy, technology, and partnerships, professional sports organizations can defend their data, protect their fans, and preserve the trust that is the foundation of their industry. Cybersecurity is no longer a supporting function. It is part of the game.

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599

U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391

www.checkpoint.com

© 2025 Check Point Software Technologies Ltd. All rights reserved.