An Iran-linked hacking group called Handala claims it penetrated FBI surveillance drone systems and has now issued a direct threat against World Cup team buses, a boast that, if even partially true, would represent a serious failure in American security infrastructure during the largest sporting event the country has ever hosted.
The group said it had access to American surveillance drone footage and imagery "for months," including facial recognition captures and license plate screening data, the U.S. Sun reported. SITE Intelligence Group, which monitors jihadist organizations, said Handala released a statement detailing the claims this week.
The FBI has not confirmed any breach. No attack has been reported. But the threat lands at a moment when the federal government is supposed to be demonstrating it can protect millions of visitors and dozens of national teams on American soil, and when Iran-linked cyber actors are already on the Justice Department's radar.
Handala's statement, as relayed by SITE Intelligence Group, claimed access to "every image and every suspect" captured by FBI first-person-view drones over the last few months. The group's message to American authorities was blunt:
"Better tighten your World Cup security, we don't like some of those teams at all."
The hackers went further, referencing drone-equipped attacks in language designed to unsettle:
"Don't forget: FPVs are everywhere; you never know when one might end up right in your team's bus."
None of these claims have been independently verified. The FBI has issued no direct statement about the alleged breach or the threat. No leaked data has been authenticated by any U.S. agency in the reporting. Handala's statement names no specific team, city, stadium, or fan event.
That ambiguity does not make the threat irrelevant. It makes it harder to assess, and harder to dismiss.
Handala is not an unknown actor. The U.S. State Department currently has a bounty of roughly £7 million on any members of the group. The Justice Department has previously warned about the potential for cyberattacks by Iranian-linked actors amid the broader U.S.-Israeli confrontation with the Islamic Republic.
In March, Handala claimed to have hacked FBI Director Kash Patel's email account and published personal photos and other material online. That claim, too, has not been confirmed or denied publicly by the bureau. But the pattern is consistent: a group with known Iranian ties, escalating its provocations against American law enforcement and intelligence targets.
The Justice Department has previously moved to dismantle Iranian cyber propaganda networks operating inside the United States. The question now is whether those efforts have kept pace with the operational ambitions of groups like Handala, or whether the government's defensive posture has gaps that hostile actors are learning to exploit.
The FBI has deployed various drones to help protect the World Cup from unauthorized aircraft. UAV flights will be banned over U.S. stadiums hosting matches and over fan events related to the competition. Those measures are standard for a major international event.
But the Handala claim flips the security equation. If a hostile foreign group can access the imagery those drones collect, facial recognition data, license plate scans, suspect tracking, the surveillance tools meant to protect the public become intelligence assets for an adversary.
That scenario has not been confirmed. It remains a claim from a group with every incentive to exaggerate its capabilities. Still, the FBI itself has warned about the risks foreign actors pose to Americans' personal data, including through technology most people never think twice about. A breach of law enforcement drone systems would represent a far more direct and dangerous version of the same vulnerability.
U.S. authorities say they are working to safeguard visitors for the tournament. The specific measures beyond the drone flight bans remain largely undisclosed in public reporting.
While American security agencies face questions about whether their systems have been compromised, FIFA President Gianni Infantino has struck a notably different tone. Infantino told World Cup critics to "chill, relax" and insisted FIFA had done more than any government to work with U.S. authorities on the tournament.
Infantino also attempted to cast FIFA as a force for good, claiming the organization's intercession ensured Iran could take its place in the competition. He rejected arguments that he should have done more to stand up to Donald Trump and dismissed criticisms of ticket prices, saying they were comparable to basic prices for major sports events and concerts in the United States.
"This shows the prices were accurate."
The FIFA president's reassurances arrive alongside a tournament that has already drawn complaints from fans around the world who have been denied visas. The broader backdrop includes what the reporting describes as travel chaos and referee controversies, including Infantino's expressed regret over the banning of Somalian referee Omar Artan.
None of that inspires particular confidence that the organizational side of this World Cup is running with the discipline the security environment demands.
Handala's claims fit a pattern of escalating foreign cyber intrusions targeting American institutions. The U.S. intelligence community has acknowledged that foreign actors accessed sensitive American data in previous election cycles, sometimes without public disclosure for years. Critical infrastructure, from hospitals to defense networks, has faced repeated attacks from state-linked groups.
The common thread is a gap between the government's stated commitment to cybersecurity and the reality of what hostile actors are able to reach. A cyberattack that crippled a Massachusetts hospital earlier this year forced ambulance diversions and canceled cancer treatments. That was a regional facility. The World Cup is a global stage, with tens of thousands of people concentrated in predictable locations at predictable times.
The Justice Department warned about Iranian-linked cyber threats. The State Department put a multimillion-dollar bounty on Handala's members. And yet, according to the group's own claims, it had months of access to FBI drone imagery.
If that claim is false, the FBI should say so. If it is true, the American public deserves to know what went wrong and what has been done to fix it. Silence from the bureau serves neither security nor accountability.
No U.S. agency has confirmed or denied the breach. No official has addressed whether any FBI drone data was compromised. No statement has identified which teams, if any, face specific threats. No timeline has been offered for when the alleged access began or whether it has been terminated.
The gap between the gravity of the claim and the silence of the response is itself a problem. Americans hosting this event, and the foreign visitors attending it, are entitled to more than "chill, relax" from FIFA and radio silence from the FBI.
Iran-linked actors are probing American systems, issuing public threats against a marquee event on U.S. soil, and claiming access to law enforcement surveillance tools. Whether Handala's boasts are real or inflated, the fact that a sanctioned foreign hacking group feels bold enough to make them tells you something about the state of deterrence.
When the people charged with protecting the country won't even confirm or deny that the walls have been breached, the silence speaks louder than any reassurance could.
