Argentine Football Association systems reportedly compromised after nearly year-old infostealer infection

The Argentine Football Association (AFA) may have been compromised due to an infostealer infection that occurred nearly a year prior, according to Hudson Rock. The incident appears to be linked to an aggrieved football fan following Argentina's elimination of Egypt from the World Cup, as reported by The Register.

The breach was discovered after mass emails were sent from legitimate AFA domains, claiming Argentina "stole" the win from Egypt. Hudson Rock found evidence of an infostealer infection dating back to September 8, 2025, on a device belonging to an AFA software developer. The attackers likely gained administrative control, including access to databases, management portals, and the competition system. Researchers noted the reuse of weak, easily guessable passwords across internal systems.

Advertisements on cybercrime forums offered AFA data for sale, including staff and partner information, with some passwords found in plaintext, indicating a significant security oversight. The AFA has stated it is investigating the potential unauthorized access and implementing security measures.

Source: The Register