{"id":1983,"date":"2026-06-17T18:59:36","date_gmt":"2026-06-17T22:59:36","guid":{"rendered":"https:\/\/carleton.ca\/cipser\/?p=1983"},"modified":"2026-06-17T18:59:37","modified_gmt":"2026-06-17T22:59:37","slug":"fifa-2026-critical-infrastructure-security","status":"publish","type":"post","link":"https:\/\/carleton.ca\/cipser\/2026\/fifa-2026-critical-infrastructure-security\/","title":{"rendered":"The FIFA World Cup and Canada\u2019s Critical Infrastructure: Are Our Host Cities\u2019 Energy and Water Utilities Secure?"},"content":{"rendered":"\n
\n
\n\n
\n
\n
\n

\n The FIFA World Cup and Canada\u2019s Critical Infrastructure: Are Our Host Cities\u2019 Energy and Water Utilities Secure?\n <\/h1>\n \n \n \n\n

By Bettina Koschade and Shari St.John | Members of NC-CIPSeR Water Sector Task Force<\/p>\n\n\n <\/header>\n\n <\/div>\n\n <\/div>\n\n <\/div>\n<\/section>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The threat environment with large sporting events:<\/strong><\/h2>\n\n\n\n

Large sporting events attract big crowds of fans and spectators, and they also attract the attention of malicious actors. With FIFA Cup 2026 just around the corner, securing our critical infrastructure (CI) in host cities against physical and cyber attacks is a top priority.<\/p>\n\n\n\n

In the last 10 years, risks against CI during high-profile sporting events have undeniably increased, with water and power utilities targeted during recent Olympics and soccer tournaments. During the World Cup in Qatar in 2022 and the UEFA Euro Championships in 2024, several nations probed the CI of host cities, infiltrating operational control systems and mapping weak points for future exploitation.[i]<\/a> At the Paris 2024 Olympic Games, security companies were hired to help monitor and manage physical and cyber threats targeting the water systems, roadways, housing facilities, and much more. Over the two-month period, they managed 485,000 threat alerts and 15 high priority cyber incidents.[ii]<\/a> There is no doubt that the increase in threats and risks during high-profile events is real.<\/p>\n\n\n\n

Threat actors are typically motivated by ideology, nationalism, financial incentives, or notoriety and reputation in criminal organizations.[iii]<\/a>  These motivating factors make critical infrastructure, such as power and water utilities, high-value targets. Disrupting energy and water services can inspire public outcry and fear, while ransomware on critical utility network data can create large payouts for the perpetrator.<\/p>\n\n\n\n

In normal operating environments, water and wastewater utilities across North America are already experiencing cyberattacks on their information technology (IT) and operational technology (OT) systems. Cyber alerts and advisories from federal organizations in Canada commonly identify vulnerabilities, attempted exploits, and successful hacks into our water and wastewater systems. During high-profile sporting events, and amidst current heightened geopolitical tensions around the globe, these attacks may become even more likely as increased attention is brought to host cities.[iv]<\/a><\/p>\n\n\n\n

Threats against CI are not unique to specific parts of the globe; and the government of Canada has certainly recognized the increased risk to national security while hosting large-scale events.[v]<\/a> In 2024, the Canadian Centre for Cybersecurity released a cyber threat bulletin highlighting risks associated with high-profile events, writing:<\/p>\n\n\n\n

We assess that major international sporting events are compelling targets for a             variety of cyber threat activities, including cybercrime, hacktivism, state-sponsored                        cyber espionage, and state-sponsored disruptive or destructive cyber attacks.[vi]<\/a><\/p>\n\n\n\n

The FIFA Cup 2026 is a particularly notable event, drawing massive crowds across three host countries: Canada, the United States of America (USA), and Mexico. Soccer is the most popular international sport and has historically been a common target for malicious actors.[vii]<\/a> In the last 50 years, 45% of physical terrorist attacks targeting sporting events involved soccer venues.[viii]<\/a> A big-name event like the World Cup offers state-sponsored and lone wolf actors alike a symbolic platform to make political statements by threat messaging, seeking media attention, and creating a sense of public insecurity and disruption.<\/p>\n\n\n\n

The Canadian Centre for Cyber Security noted in 2024 that cyber-criminals are most likely to target large organizations during sporting events.[ix]<\/a> The organizing bodies and high-profile athletes are encouraged to take extra precautions to prepare against known risks, and stadiums must implement effective security measures to protect spectators.[x]<\/a> However, there are many more assets at risk during these games. Attacking a network of the host city\u2019s interconnected critical infrastructure can create cascading effects that can disrupt not only the tournament itself,[xi]<\/a> but the whole metropolitan area: from the transit system to the power grid to water and wastewater infrastructure. This puts the health and safety of all residents at risk.Host countries must be prepared to detect, respond, and recover from these physical and cyber acts.<\/p>\n\n\n\n

This summer, in June and July, FIFA World Cup games are scheduled right in the centre of our biggest Canadian cities: Six games at the Toronto Stadium (BMO Field) located at the downtown waterfront of Lake Ontario and seven games at BC Place Vancouver, located in the core of the city.Even without intentional disruptions, the water and wastewater infrastructure of these host cities will be stressed by the temporary yet significant influx in population from visiting spectators. Many of the U.S. host cities already face water stress, and aging infrastructure is a common risk across all host cities.[xii]<\/a> Water and wastewater utility operators in these host venues will be monitoring systems closely to keep operations running efficiently and to respond immediately to any issues.<\/p>\n\n\n\n

Canada\u2019s Water and Wastewater Infrastructure<\/strong><\/h2>\n\n\n\n

Canada has recently recognized the need to deal with the vulnerabilities in our country\u2019s water and wastewater infrastructure\u2014it is a public safety issue. Water is a critical asset and therefore a high-value target to malicious actors, necessitating better protections and risk mitigation to reduce our growing exposure to attacks.[xiii]<\/a> Water utilities extend far beyond the perimeter of the treatment plant; there are often thousands of kilometres of water main pipes,[xiv]<\/a> along with pressure release valves, pump stations, and storage tanks scattered across a big city. Also scattered across various water and wastewater sites is operational technology (OT) which supports water and wastewater systems through remote monitoring, data logging, and operation of equipment. The Centre for Cyber Security has identified OT systems within water utilities as the primary target for actors seeking to disrupt water systems.[xv]<\/a> With these known advisories, and water utilities already experiencing cyberattacks on a daily basis, increased cybersecurity on standard enterprise networks and OT networks is increasingly imperative to maintain safe and healthy drinking water for Canadians.[xvi]<\/a><\/p>\n\n\n\n

However, most of our country\u2019s water utilities were designed decades ago, without cyber-security in mind. The threat landscape has changed drastically over the years, especially with the rise of artificial intelligence (AI), which now rapidly and visibly exposes weaknesses in our essential services. A lack of vigilance and commitment of resources to better cyber protections will result in system security being outpaced by AI capabilities and exploits.<\/p>\n\n\n\n

There is no question that the water industry will continue to increase its reliance on technology for service delivery, including automation and digitization. These are key solutions to meet the growing demand for water and wastewater treatment given population growth and more extreme weather events, and it even helps extend the life of our aging water infrastructure.[xvii]<\/a> But it can also increase our vulnerability if security of the technology is not a priority.<\/p>\n\n\n\n

ENHANCED SECURITY WITH A WHOLE-OF-SOCIETY APPROACH<\/strong><\/h2>\n\n\n\n

Despite a real and complex threat environment, water and wastewater system security is still achievable through effective planning, implementation of risk mitigation measures, and continuous vigilance. For our immediate event-risk management, the security industry promotes an intelligence-led approach with real-time political monitoring, cyber-threat visibility, and infrastructure disruption awareness.[xviii]<\/a> Physical security measures as simple as locking gates, building doors, and windows, and doing regular patrols of water and wastewater asset sites can be highly effective in deterring malicious actors. For an immediate improvement to cybersecurity, double-checking that your default passwords on IT and OT systems have been updated, and that remote access to critical equipment is restricted can be effective measures for limiting unauthorized access to networks. And for longer-term cybersecurity solutions which may require a greater commitment of time and resources, the government of Canada offers guidance based in industry best practices, such as the Cybersecurity Readiness Goals (CRGs)[xix]<\/a> informed by The NIST Cybersecurity Framework 2.0.<\/em>[xx]<\/a><\/p>\n\n\n\n

Preliminary research on the security impact of large-scale sporting events on our CI highlights not only the vulnerabilities and threats against infrastructure during planned occasions, but also the potential mitigation approaches to protect our essential services year-round. However, it also uncovers the gap in research literature on the connection between large sporting events and the risk placed on the country\u2019s critical infrastructure,[xxi]<\/a> which is at best a burgeoning field of study. Lessons learned from the planning and discussions around water and wastewater systems supporting the FIFA Cup 2026 event may serve as a necessary launchpad for research into this critical area of study.<\/p>\n\n\n\n

Indeed, a whole-of-society approach is what\u2019s needed. By adopting a more community-centered security management approach to build resilience through awareness, preparedness, and mitigation we can create stronger links between citizens and the efforts and strategies of industry and government. During such a momentous event as the World Cup in Canada, there is an opportunity to benefit from the spirit of both the fans attending and the surrounding community.[xxii]<\/a> As large-scale events continue to occur across our cities, identification of interdependencies between CI systems such as power, water, transportation, and more will become invaluable in risk mitigation planning to protect our infrastructure, our national security, and our people.<\/p>\n\n\n\n

Endnotes<\/h2>\n\n\n\n
\n\n\n\n

[i]<\/a> Dave Rubenstein, host, The World Cup and Water\u2019s Cyber-Preparedness Opportunity with 1898 & Co.\u2019s Victor Atkins<\/em>, episode 284, The Water Values Podcast, Bluefield Research, February 3, 2026, 50:38, https:\/\/www.bluefieldresearch.com\/podcast\/the-world-cup-and-waters-cyber-preparedness-opportunity-with-1898-co-s-victor-atkins\/.<\/p>\n\n\n\n

[ii]<\/a> Nozomi Networks, \u201cProtecting the 2024 Paris Olympics Critical Infrastructure from Cyber Threats,\u201d 2024, https:\/\/www.nozominetworks.com\/case-studies\/protecting-the-2024-paris-olympics-critical-infrastructure-from-cyber-threats.<\/p>\n\n\n\n

[iii]<\/a> Canada, The Cyber Threat to Canada\u2019s Water Systems: Assessment and Mitigation<\/em> (Canadian Centre for Cyber Security, 2025), https:\/\/www.cyber.gc.ca\/en\/guidance\/cyber-threat-canadas-water-systems-assessment-mitigation; Ariel Stern and Yair Poleg, \u201cCyber Security for Water Utilities,\u201d Water Canada<\/em>, August 9, 2021, https:\/\/www.watercanada.net\/cyber-security-for-water-utilities\/.<\/p>\n\n\n\n

[iv]<\/a> Mike Lantz, \u201cSecurity Risks for the 2026 FIFA World Cup in North America,\u201d Paladin Security<\/em>, March 19, 2026, https:\/\/paladinsecurity.com\/security-prevention\/2026-world-cup-security-risk-north-america\/.<\/p>\n\n\n\n

[v]<\/a> Canada, Cyber Threat Bulletin:  Cyber Threats to Major International Sporting Events<\/em> (Canadian Centre for Cyber Security, 2024), https:\/\/www.cyber.gc.ca\/sites\/default\/files\/cyber-threat-major-international-sporting-event-e_0.pdf; Lantz, \u201cSecurity Risks for the 2026 FIFA World Cup in North America.\u201d<\/p>\n\n\n\n

[vi]<\/a> Ibid<\/em>.<\/p>\n\n\n\n

[vii]<\/a> Grace R. Rahman et al., \u201cTerrorist Attacks against Sports Venues: Emerging Trends and Characteristics Spanning 50 Years,\u201d Prehospital and Disaster Medicine<\/em> 38, no. 3 (2023): 366\u201370, https:\/\/doi.org\/10.1017\/S1049023X23000377.<\/p>\n\n\n\n

[viii]<\/a> Rahman et al., \u201cTerrorist Attacks against Sports Venues.\u201d<\/p>\n\n\n\n

[ix]<\/a> Canada, Cyber Threat Bulletin:  Cyber Threats to Major International Sporting Events<\/em>.<\/p>\n\n\n\n

[x]<\/a> Camille Singleton, \u201cCybersecurity at the World Cup: What You Should Know,\u201d IBM X-Force Threat Intelligence, June 6, 2018, https:\/\/www.ibm.com\/think\/x-force\/cybersecurity-at-the-world-cup-what-you-should-know.<\/p>\n\n\n\n

[xi]<\/a> Lantz, \u201cSecurity Risks for the 2026 FIFA World Cup in North America.\u201d<\/p>\n\n\n\n

[xii]<\/a> Rubenstein, The World Cup and Water\u2019s Cyber-Preparedness Opportunity with 1898 & Co.\u2019s Victor Atkins<\/em>; Megan Bondar, \u201cAre U.S. Water Systems Ready for World Cup 2026?,\u201d Bluefield Research<\/em>, April 3, 2026, https:\/\/www.bluefieldresearch.com\/are-u-s-water-systems-ready-for-world-cup-2026\/.<\/p>\n\n\n\n

[xiii]<\/a> Canada, The Cyber Threat to Canada\u2019s Water Systems<\/em>.<\/p>\n\n\n\n

[xiv]<\/a> Ariel Stern and Yair Poleg, \u201cCyber Security for Water Utilities,\u201d Water Canada<\/em>, August 9, 2021, https:\/\/www.watercanada.net\/cyber-security-for-water-utilities\/.<\/p>\n\n\n\n

[xv]<\/a> Canada, The Cyber Threat to Canada\u2019s Water Systems: Assessment and Mitigation<\/em> (Canadian Centre for Cyber Security, 2025), https:\/\/www.cyber.gc.ca\/en\/guidance\/cyber-threat-canadas-water-systems-assessment-mitigation.<\/p>\n\n\n\n

[xvi]<\/a> Stern and Poleg, \u201cCyber Security for Water Utilities.\u201d<\/p>\n\n\n\n

[xvii]<\/a> Stern and Poleg, \u201cCyber Security for Water Utilities.\u201d<\/p>\n\n\n\n

[xviii]<\/a> Mike Lantz, \u201cSecurity Risks for the 2026 FIFA World Cup in North America,\u201d Paladin Security<\/em>, March 19, 2026, https:\/\/paladinsecurity.com\/security-prevention\/2026-world-cup-security-risk-north-america\/.<\/p>\n\n\n\n

[xix]<\/a> Canada, Cyber Security Readiness Goals: Securing Our Most Critical Systems<\/em>, Version 1.0 (Canadian Centre for Cyber Security, 2024), 24; Canada, Cyber Security Readiness Goals: Cross-Sector Toolkit<\/em>, Version 1.0 (Canadian Centre for Cyber Security, 2024), 28, https:\/\/www.cyber.gc.ca\/sites\/default\/files\/cyber-readiness-goals-toolkit-e.pdf.<\/p>\n\n\n\n

[xx]<\/a> U.S. Department of Commerce, The NIST Cybersecurity Framework (CSF) 2.0<\/em>, NIST CSWP 29 (National Institute of Standards and Technology, 2024), NIST CSWP 29, https:\/\/doi.org\/10.6028\/NIST.CSWP.29.<\/p>\n\n\n\n

[xxi]<\/a> Stacey A. Hall, ed., Routledge Handbook of Sport Security<\/em>, 1st ed. (Taylor & Francis Group, 2026), https:\/\/doi.org\/10.4324\/9781032641300.<\/p>\n\n\n\n

[xxii]<\/a> Brian E. Menaker et al., \u201cRethinking Sport Event Security: From Risk Management to a Community Driven Approach,\u201d Journal of Global Sport Management<\/em> 9, no. 2 (2024): 346\u201368, https:\/\/doi.org\/10.1080\/24704067.2021.1929388.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

The threat environment with large sporting events: Large sporting events attract big crowds of fans and spectators, and they also attract the attention of malicious actors. With FIFA Cup 2026 just around the corner, securing our critical infrastructure (CI) in host cities against physical and cyber attacks is a top priority. In the last 10 […]<\/p>\n","protected":false},"author":340,"featured_media":1985,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[24],"tags":[73,80,74,81,66,68,43,85,79,82,83,76,84,78,75,77,72],"class_list":["post-1983","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nc-cipser","tag-critical-infrastructure-protection","tag-critical-infrastructure-resilience","tag-cyber-security","tag-emergency-management","tag-fifa-2026","tag-infrastructure-security","tag-national-security","tag-nc-cipser","tag-operational-technology-security","tag-risk-assessment","tag-toronto","tag-utility-security","tag-vancouver","tag-wastewater-infrastructure","tag-water-security","tag-water-utilities","tag-world-cup-2026"],"acf":{"cu_post_thumbnail":""},"_links":{"self":[{"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/posts\/1983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/users\/340"}],"replies":[{"embeddable":true,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/comments?post=1983"}],"version-history":[{"count":3,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/posts\/1983\/revisions"}],"predecessor-version":[{"id":1989,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/posts\/1983\/revisions\/1989"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/media\/1985"}],"wp:attachment":[{"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/media?parent=1983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/categories?post=1983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/carleton.ca\/cipser\/wp-json\/wp\/v2\/tags?post=1983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}