Why World Cup cyber risk sat in the city services residents use every day
Stadiums had federal, state and venue security teams. The exposure host-city agencies owned was in the services around them: resident and visitor channels, transit and traffic systems, 911 and dispatch, and vendors shared across jurisdictions.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
The 2026 FIFA World Cup opened on June 11 at Estadio Azteca in Mexico City. It was the first edition with 48 teams and 104 matches, and the first shared by three countries. Matches were scheduled in sixteen host cities: eleven in the United States, three in Mexico and two in Canada, with the final set for July 19 at MetLife Stadium in East Rutherford, New Jersey. An executive order in March 2025 had created a White House Task Force on the FIFA World Cup 2026. Federal, state and local agencies had been planning security for more than a year. In the week of June 8, the first US matches were days away. City and county technology teams in the host regions were entering five weeks of sustained, elevated demand on public services.
Security inside and around the stadiums was planned by federal agencies, state police and venue operators with long experience of large events. That work drew most of the attention. The exposure that belonged to city and county agencies was less visible and more spread out. It sat in four places that do not overlap. The first is the channels residents and visitors use to find official information and pay for things. The second is the operational technology that moves traffic and transit. The third is the emergency communications chain, and the fourth is the vendors that several host jurisdictions share. Each called for a different kind of plan, owned by a different part of local government.
Resident and visitor channels
Large events attract fraud that borrows a host city’s identity. Fake parking permits, counterfeit transit passes, impostor visitor-information sites and bogus fan-zone registrations all exploit the same moment: someone searching quickly on a phone for official information. Agencies cannot take every lookalike site down. They can make the official channel easy to find and easy to recognize.
In practice that means registering likely lookalike domains before the event, monitoring for new impersonation sites, and publishing one short list of official channels that every department and partner repeats. Pages built for a small screen and offered in the languages visitors actually use do security work too. A visitor who finds the parking page in Spanish or Portuguese is less likely to follow a link from a text message.
The same channels face legitimate surges. Permit portals, parking payment systems and 311 lines can see volume they were never sized for. Load testing and a written decision about which features to switch off under strain matter here. Without them, a capacity failure can look like an attack, and an attack can hide inside a capacity failure. The owner is usually the digital services team, working with communications staff who control the public message.
Transit and traffic technology
Traffic signal controllers, transit fare and signaling systems, parking garage equipment and building management systems near venues are operational technology. Many were designed for reliability and long service lives. Some are reachable from the internet for remote maintenance. Federal advisories in recent years have repeatedly warned about exposed control interfaces in municipal water and other local systems.
Six weeks is too short to re-architect any of this. It is long enough to do four things. Agencies can list the OT systems within the event footprint and who maintains each one. They can close or gate internet exposure they find. They can confirm that vendor remote access runs through a controlled, logged path, and can be cut off without stopping operations. And they can rehearse the manual fallback, such as fixed signal timing plans or staffed fare gates, with the people who would actually run it. The owner here is the transportation or public works department, which often has its own technology staff outside the city CIO’s reporting line.
The emergency communications chain
Public safety answering points and computer-aided dispatch are the most consequential systems a city runs during an event. They face heavier call volumes and can be targeted with call flooding or ransomware. They also depend on carriers, regional 911 networks, radio systems and software vendors that the agency does not control.
The planning questions are about continuity. A center needs to know where calls route if it is overwhelmed or offline. Dispatchers need a way to work if CAD is down, with paper run cards and current unit status boards. Mutual aid partners need a way to share incident information if a shared platform fails. And someone has to be able to tell, quickly, that a pattern of calls is malicious. Many centers had answers in their continuity plans. A major event was a reason to test those answers under realistic load, with the regional partners in the room, before the first match.
Vendors shared across host jurisdictions
Host cities and neighboring counties often buy from the same small group of vendors for parking, mobility apps, public Wi-Fi, digital signage, permitting and event management. A compromise or outage at one provider can hit several jurisdictions at the same time. No single city sees the whole dependency map.
The useful response is regional. Agencies can share their lists of event-critical vendors with neighbors and with the state fusion center, so overlaps become visible. They can agree in advance who will contact a shared provider during an incident, and how findings will be passed along, so one vendor is not fielding a dozen uncoordinated calls. They can also ask each critical vendor directly about event staffing, escalation contacts and how it would notify customers. These are inexpensive steps. They depend on someone, usually a state or regional body, being willing to convene them.
The four parts have different owners and budgets, which is why they tend to be planned unevenly. Digital services, transportation, public safety and procurement rarely sit in one governance meeting. The host regions that brought them together for the World Cup also built a working group they can reuse for the next large event or the next regional emergency.
With hindsight
From October 2026, the tournament is over. As far as public reporting shows, no disruptive cyberattack on a US host-city government was widely reported during the matches. Security firms had warned beforehand of fraud, hacktivist denial-of-service activity and ransomware aimed at hospitality and ticketing. The absence of a public incident does not prove the plans were tested, and many after-action reviews will stay internal. What carries forward is the planning itself. Inventories of event-area operational technology, rehearsed 911 continuity procedures, shared vendor lists and regional contact trees do not expire when the crowds leave. Agencies that folded this work into standing programs are better placed for storms, outages and the next large event. Host agencies would be wise to write down their own findings while the staff who ran operations are still in place.