As the 2026 FIFA World Cup approaches, spanning host cities across the United States, Canada, and Mexico, cybersecurity has emerged as a top concern for travel industry stakeholders. The tournament's massive digital ecosystem—connecting ticketing platforms, booking systems, transportation networks, and payment gateways—creates an expanded attack surface that cybercriminals are poised to exploit. In an exclusive interview with Travelmao, Justin Miller, M.S., Program Director of Cybersecurity at the University of Tulsa, dissects the converging threats and offers actionable guidance for airlines, hoteliers, tour operators, and travel-tech vendors.
Converging Threats: From Ticketing Fraud to Infrastructure Attacks
Miller emphasizes that the most dangerous scenario is not a single catastrophic breach but the convergence of multiple smaller attacks causing cascading operational failures. “Ticket fraud will absolutely occur, but from a public safety standpoint, transportation disruptions and attacks against critical infrastructure concern me most because they create cascading effects,” he says. A ransomware incident affecting airport systems—such as those used by Delta Air Lines or United Airlines—or rail scheduling for Amtrak or Via Rail could quickly escalate from an IT problem to a public safety issue. Misinformation campaigns spreading false reports of venue changes or transportation delays on social media can amplify confusion at scale.
Travel companies should prepare for an explosion of fraud tied to urgency and scarcity: fake ticket sites, fraudulent lodging offers, phishing emails impersonating airlines or FIFA-related organizations, and cloned booking websites. Miller warns of QR-code ticket scams, fraudulent mobile apps, and spoofed customer-service phone numbers designed to steal payment information. Credential stuffing attacks against loyalty accounts—such as those managed by Marriott Bonvoy or Hilton Honors—and business email compromise targeting reservations staff are also likely. Ransomware attempts aimed at interrupting booking systems during peak travel periods, like those operated by Sabre or Amadeus, pose a significant risk.
Transportation Systems at Risk
The risk to airports, airlines, and urban transit networks is realistic, though not necessarily catastrophic. “The most probable scenario is not a Hollywood-style takedown of an airport, but temporary service degradation: delayed check-ins, reservation outages, baggage disruptions, payment failures, or scheduling confusion caused by cyber incidents affecting interconnected systems,” Miller explains. Transportation systems are increasingly digitized and dependent on third-party vendors, which expands the attack surface considerably. During an event like the World Cup, even a short outage can have outsized consequences, affecting millions of fans traveling between cities like New York, Los Angeles, Toronto, and Mexico City.
Miller points to recent incidents—such as the 2024 CrowdStrike outage that disrupted airlines globally—as lessons in resilience. “Organisations must assume they will experience attempted compromises and prepare to operate through them,” he says. Key measures include network segmentation, backup communications, offline contingency plans, and tabletop exercises that include cyber scenarios. For example, if ticket validation systems fail at a stadium, what is the manual backup? If transportation apps go offline, how do fans receive trusted information? Vendor risk management is equally critical, as major events depend heavily on contractors, cloud providers, payment processors, and third-party logistics.
Practical Steps for Hospitality and Tourism Businesses
Hotels, restaurants, and tourism providers should view themselves as high-value targets during the World Cup. Miller recommends implementing multi-factor authentication, training staff to identify phishing attempts, patching internet-facing systems, segmenting payment networks from guest Wi-Fi, and rehearsing ransomware response procedures. “A hotel should know exactly what happens if reservation systems fail or payment systems go down during peak occupancy,” he says. Preparedness often determines whether an incident becomes an inconvenience or a crisis.
For travel agents and tour operators, the focus should be on securing booking platforms and communication channels. The recent Gold Medal USA & Canada campaign tied to World Cup 2026 highlights the importance of robust cybersecurity in promotional efforts. Similarly, the Central Florida hospitality sector gearing up for the fan influx must ensure that guest data and payment systems are protected.
Effective collaboration between governments, stadium operators, transport providers, hotels, and technology companies is essential. Miller advocates for moving beyond information sharing to joint planning and testing. “Security is only as strong as the weakest connected partner,” he warns. As the industry prepares for the world's biggest sporting event, cyber resilience must be a core component of operational strategy—not an afterthought.
