Saudi World Cup Contractor Hack Exposes 1.5 Million Files, Cyber Group Says

The National reported that hackers stole more than 1.5 million files from a Saudi construction consortium tied to a planned 2034 Fifa World Cup stadium, exposing about 17 terabytes of material in a breach flagged by UAE-based cyber threat monitor Hackmanac.

The compromised records include documents, contracts, payment information, stadium designs and personal data for 150,000 employees.

Hackmanac placed the October 3 incident at the China Railway Construction Corporation/Sama Construction consortium and identified the group as the main contractor for Jeddah Central Stadium, one of the venues planned for the tournament.

Hackmanac attributed the attack to WallStreet, a hacking group that cybersecurity firm SOCRadar says emerged prominently this year.

SOCRadar's profile describes the group as a double-extortion operation that uses sensitive data breaches to pressure victims into compliance.

The profile lists activity across sectors and says WallStreet has claimed at least 32 attacks globally, with notable operations in the United States and Ecuador.

The incident brings a cyber risk into Saudi Arabia's preparations for the 2034 World Cup, which the kingdom is set to host as the sole nation selected for the tournament.

Current plans cover 15 stadiums in five cities, including eight in Riyadh and 11 new venues, among them the proposed 92,000-seat King Salman Stadium.

Saudi football officials have framed the host-city plan around state-of-the-art facilities and fan experience, but the reported breach centers on construction and project data rather than match operations.

CRCC and Saudi Arabia's National Cybersecurity Council had not responded to requests for comment.

The material unknown is whether the stolen files have affected project security, contractor operations or official containment measures.