Five Separate Threats Shadowed the 2026 World Cup — Here's Every One the FBI and DHS Have Disclosed.
The 2026 FIFA World Cup ran 104 matches across 16 cities in three countries over five weeks — and by the time it closed July 19 with zero major security incidents at any match, federal officials had disclosed at least five distinct threats they say were caught first. Only one has produced an arrest and a federal indictment; the rest range from a vaguely described vehicle plot to a cyberattack no one has attributed to anyone.
This piece keeps all five separate, on purpose. Blending them into one number would flatten a genuinely uneven record — one prosecuted conspiracy, one unconfirmed disclosure, one unresolved breach, one disputed hacking claim, and one routine fraud warning.
- 8 — men federally indicted in the alleged plot to attack the UFC 'Freedom 250' event at the White House
- Sept. 14, 2026 — trial date set for the two defendants already arraigned — all eight remain presumed innocent
- 600+ to ~2,000 — range of drones federal and state officials say were intercepted across host cities — figures conflict by agency and are not reconciled here
- $10 million — reward the U.S. government has offered for identifying members of Handala, the Iran-linked group behind a disputed drone-breach claim
The most serious disclosed threat targeted “UFC Freedom 250,” a cage-fighting event held on the White House South Lawn in mid-June, coinciding with President Trump’s 80th birthday. According to the federal indictment, a group of men allegedly planned to fly explosive-laden drones at the roughly 4,000-person crowd, triggering a mass evacuation that would funnel fleeing attendees toward pre-positioned snipers. Investigators say the plot began surfacing when one defendant’s mother alerted police after he made a string of tactical-gear purchases and talked about “hit and run missions.”
FBI and our law enforcement partners became aware of a potential threat to the UFC America 250 event...
A federal grand jury in Columbus, Ohio indicted eight men on July 9 on conspiracy to provide material support to terrorists and conspiracy to murder a federal official. Two — Tycen C. Proper, 19, and Chandler D. Scaggs, 21, assigned a sniper role in court filings — were arraigned July 16 and pleaded not guilty; trial is set for September 14. No drones were actually recovered; investigators say acquisition remained in a “discussion and research” phase when the arrests were made. All eight are charged, not convicted, and presumed innocent.
DHS Secretary Markwayne Mullin (R) separately disclosed that federal, state, and local partners stopped “an intimate threat” involving vehicles aimed at a World Cup fan fest “before it became a major incident.” He would not say which city, whether the plotters were domestic or foreign, or whether anyone was arrested. Unlike the UFC case, no charging document, named suspect, or follow-up reporting has surfaced for this one — it remains a federal disclosure the public cannot independently verify.
Sometime in late May or early June, hackers breached the Homeland Security Information Network, the “sensitive but unclassified” platform that ties together threat intelligence and emergency-response coordination across federal, state, and local agencies — the same system actively supporting World Cup security planning. The intrusion went undetected for weeks during the live tournament. DHS confirmed it publicly only after trade-press reporting broke the story around July 1, saying it had “isolated the affected systems” and launched a forensic investigation. No attacker has been identified.
“The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment. We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation.”
DHS spokesperson statement
Handala Hack Team, a persona Western researchers assess is linked to Iranian intelligence, publicly claimed it had monitored FBI surveillance drones deployed for World Cup security “for months” and threatened “you never know when one might end up right in your team’s bus.” SITE Intelligence Group, which tracks the group’s claims, found no verifiable evidence supporting it — and the video Handala offered as proof turned out to be unrelated footage a drone-software company produced in December 2024 for a tornado-damage survey. The same group breached FBI Director Kash Patel’s personal Gmail in March, prompting a $10,000,000 federal reward for information identifying its members, later extended to cover the World Cup claim as well. No one has been arrested.
seized over 600 drones from restricted airspace across all 11 U.S. host cities
Not every disclosed threat was a plot against people. In May, the FBI’s Internet Crime Complaint Center warned fans about more than 36 spoofed FIFA websites — typosquatted domains built to sell counterfeit tickets, harvest payment information, and run fake job postings, spread largely through malicious advertising. It is a fraud advisory, not a physical-security case, but it drew the same “FBI warns” headline treatment as the four incidents above — worth separating clearly rather than letting it inflate a “threats stopped” tally that means something different case to case.
The World Cup turned out to be a spectacular SUCCESS! ...kept this Great Championship the Safest and Most Spectacular World Cup in History, BY FAR!
Posted July 20, 2026, the day after the tournament's final match, thanking law enforcement, Andrew Giuliani, and FIFA's Gianni Infantino by name.
Kash Patel — FBI Director; announced the UFC plot arrests, drawing Secret Service criticism for disclosing details of a sealed investigation while suspects remained at large.
Markwayne Mullin (R) — DHS Secretary, confirmed 54–45 in March 2026; disclosed the fan-fest vehicle threat and the drone-interception figures.
Dominick S. Gerace II — U.S. Attorney, Southern District of Ohio, prosecuting the eight UFC-plot defendants.
Andrew Giuliani — led the White House Task Force on FIFA World Cup security.
The World Cup ended with no attack at any match — but the record behind that outcome is more mixed than “threats thwarted” suggests. One alleged plot produced eight federal defendants and a September trial date. A second threat was disclosed with no case file at all. A third was a cyberattack on the government’s own coordination network that nobody has explained. A fourth was a hacking claim researchers couldn’t verify. Only the fifth — a ticket-scam warning — was exactly what it said it was.
