The Olympics Is a Hacker’s Favorite Sporting Event

The opening ceremony hasn’t even ended when the first attacks land. The world is watching. The networks are straining. And somewhere in the noise of a billion connected devices, an attacker — possibly state-sponsored, possibly just opportunistic — is already inside.

“Global occasions like the Olympics attract attackers who are motivated by visibility, disruption, and influence rather than solely financial gain,” says Anthony Cusimano, solutions director at ObjectFirst. This distinction matters more than most CISOs realize. When the motivation isn’t money, ransomware playbooks don’t apply. You can’t negotiate your way out of a wiper attack designed to embarrass a nation on a global stage.

The receipts go back years. At the 2018 PyeongChang Winter Games, destructive malware hit the ceremony operations — a geopolitical message delivered in code. The 2020 Tokyo Games faced wiper malware timed to coincide with the opening, engineered to erase files and disable machines rather than extract a ransom. Paris 2024 saw surging DDoS campaigns and phishing operations masquerading as Olympic branding. Each iteration is a little more sophisticated, attracts more of the world’s attention, and creates more attack surface to exploit.

Identity was the door. The vendor left it open.

Ask Cusimano where defenses typically crack during major events, and he often points to identity weaknesses, vendor ecosystems and a stubborn preference for prevention over resilience.

“Stolen or phished admin credentials are among the most effective points of entry, especially when privileged accounts are over-provisioned or lack strong authentication,” he says. AI has supercharged this. Attackers are now generating highly personalized, convincing phishing campaigns targeting both fans and staff. One reported incident at the 2026 Winter Games involved an intrusion into an HVAC climate control system, a reminder that when you connect everything, you expose everything.

The third-party problem is especially acute at events like the Olympics, where temporary integrations, pop-up vendors and rapid partner onboarding are the norm. Security architecture gets assembled fast and monitored inconsistently. Legacy systems get bolted into modern infrastructure. The result, as Cusimano puts it, is “a poorly monitored and maintained security architecture” with inconsistent patching and sprawling endpoints across ticketing, broadcasting and transportation systems.

The urgency of running a live global event makes it worse. Emergency access paths get created. Blind spots widen. The pressure to keep the show running conflicts directly with the discipline required to keep it secure.

Stop planning to prevent it. Plan to survive it.

For any organization involved in a major 2026–2028 sporting event, Cusimano’s message is unambiguous: You will be breached. Design around that assumption now, not after the opening ceremony.

“Any organization that is preparing for a major 2026–2028 sporting event should automatically assume that it will be breached, and defenses should be designed around this assumption,” he says. That means Zero Trust Network Access, least-privileged credentials and network segmentation separating production systems from broadcast environments from backup infrastructure.

And it means immutable backups. Not as an afterthought but as a foundation.

Here’s what attackers know that some CISOs still underestimate: Modern ransomware and destructive malware go after backups first. They encrypt, corrupt and delete them. Eliminate the recovery path, and you eliminate the organization’s ability to say no. “Attackers know that if backup data is stolen or encrypted, companies will pay the ransom,” Cusimano notes.

The history bears this out. During the 2018 PyeongChang attack, malware was specifically engineered to manipulate and delete backups and event logs, making rapid recovery nearly impossible. At the 2016 Rio de Janeiro Olympics, criminals created a fake version of the International Olympic Committee’s intranet portal to harvest login credentials — a setup that made subsequent backup compromise trivially easy.

“Attackers know that if backup data is stolen or encrypted, companies will pay the ransom.”

If an admin can delete it, so can an attacker

Strip away the marketing language, and true immutability means exactly one thing: “Absolute immutability means that even the most privileged admin or attacker with access to backup storage cannot modify or delete data,” Cusimano says.

That’s a hard technical guarantee, not a policy setting. It requires S3 object storage with native immutability built into the protocol, not bolted on as an afterthought. Combined with S3 Object Lock and versioning, backup data is immutable from the moment it’s written. No window of vulnerability. No exceptions for insider threats or credential compromise.

For a live event where downtime is measured in broadcast slots and ticket refunds, this matters enormously. Immutability means your incident response team can restore a clean, verified state without extensive forensic validation. You’re no longer asking whether a backup was tampered with. You already know it wasn’t, so you can move forward fast and not second-guess your data integrity.

ObjectFirst customers who implemented effective disaster recovery policies saw their Recovery Point Objectives drop by 50% — from eight hours to four. In Olympics time, that’s the difference between a recoverable incident and a headline.

The drill you’ve never run is the one you’ll need

Cusimano has a short list of tabletop scenarios he insists on for any organization preparing for a major event. Most teams never run them.

The first is well known: Simulate ransomware encrypting primary data, then test decision-making under public pressure with legal, PR, IT security and executive leadership all in the room. The second is a supply chain compromise that is becoming common — a trusted vendor suddenly acting strangely. “If a scenario like a vendor suddenly requesting payment through a one-click email doesn’t raise a red flag during those drills, it’s a sign the organization isn’t prepared,” he says.

However, it is the third scenario that keeps Cusimano up at night: AI-enhanced insider threats. Attackers are now manipulating credentials and data to disguise themselves as insiders. A recent Office 365 vulnerability allowed threat actors to make recipients believe messages originated within their own organization. When the attacker appears to be a colleague, perimeter-based defenses collapse entirely.

Twelve months. Three moves. No excuses.

For organizations beginning to think about the 2028 Summer Games or any major global event, Cusimano offers a concise playbook. First: Implement Zero Trust Network Access — no user or device is trusted by default, even inside the network. Second: Build immutable, automated and regularly tested backups now, not six weeks before the event. “Failing to regularly test restoration processes means that when data is needed, it may be corrupted, incomplete, or unusable.” Third: Establish crisis-ready communication protocols with partners so that when a breach happens, everyone knows who makes the call.

What should CISOs deprioritize? Anything that creates the appearance of security without actually testing recovery. The policy-versus-plan confusion is real: Policies set the ‘what and why,’ plans specify the ‘how.’ Most organizations confuse the two and discover the gap at the worst possible moment — live, on camera, with the world watching.

The Olympics will always be a target. The question is whether we can recover fast enough that no judge notices.

Image credit: iStockphoto/Korakrich Suntornnites