Argentina Football Federation Hack Exposes Data After Egypt World Cup Row

Argentina’s football federation is investigating whether hackers hijacked one of its email accounts to accuse the World Cup champions of stealing their comeback win over Egypt. The subject line read “SYSTEM HACKED: UNFAIR DECISION.” It reached reporters two days after a stoppage time collapse that Cairo still has not forgiven.

Buried under the outrage is a quieter problem. Multiple reports say the breach exposed journalists’ email addresses, passwords and IP addresses, and a group calling itself All Egyptian Cyber Warriors claims it has more where that came from.

AFA Confirms a Breach of Its Email System

The Asociación del Fútbol Argentino, Argentina’s governing football body known everywhere as AFA, said Thursday it was examining a possible breach of one of its institutional email accounts. It stopped short of confirming the hack outright.

“There is a possibility that our account has been subject to unauthorised access,” the federation said in a statement. It added that it was working with its systems team to clarify what happened and adopt the necessary security measures.

The emails carried that ominous subject line and went out under AFA’s own name. At least one reporter for The Athletic, the subscription sports outlet, received a copy. So did other journalists accredited to cover the tournament.

Security is an illusion, just like the integrity of that match.

That line opened one section of the message, addressed to the world at large, according to Cybernews, which reviewed the email. The message called the result a robbery. It described the officiating as unfair from the opening whistle to the last.

It also claimed Egypt’s coach, Hossam Hassan, had been “targeted for standing with Palestine.” That was a reference to his outspoken support for Palestinians throughout the tournament, including an impassioned pre-match appeal for Gaza. The message closed with a warning: keep the pitch fair, or expect no peace in AFA’s networks. It was signed, simply, All Egyptian Cyber Warriors.

AFA asked anyone who received the message to ignore it, especially if it carried links, attachments or requests for personal information. By Friday, a federation spokesperson told reporters the matter had been resolved. That word would prove premature.

A Late Collapse Turns Into a Formal Complaint to FIFA

Egypt led for most of the second half in Atlanta. Yasser Ibrahim put Egypt ahead, and Mostafa Zico thought he had doubled the lead in the 58th minute, until a video review, VAR, ruled out the goal for a foul by teammate Marwan Attia on Argentina defender Lisandro Martínez in the buildup. Zico scored again nine minutes later to make it 2-0 anyway.

Argentina looked finished. Cristian Romero headed one back in the 79th minute. Lionel Messi equalized four minutes later. Enzo Fernández scored two minutes into stoppage time to complete a 3-2 win, sending the defending champions into a quarterfinal against Switzerland that plenty of fans in the United States found ways to stream World Cup knockout matches without cable.

Egypt’s federation said in a statement that it cannot remain silent regarding the decisions and formally asked FIFA to remove French referee François Letexier and his officiating crew from the rest of the tournament.

This was not the tournament’s first brush with claims of outside influence. Days earlier, President Donald Trump said he had personally asked FIFA to review and overturn a suspension for American striker Folarin Balogun, and the governing body did so. That episode had already primed fans to wonder whether decisions on the pitch were being shaped off it.

FIFA’s chief refereeing officer, Pierluigi Collina, said “nobody can question the integrity” of the tournament’s officials. Spain’s manager, Luis de la Fuente, backed the officiating too, saying the major calls were correct.

Not everyone at the broadcast desks agreed. Rob Green, the former England goalkeeper working as a Fox Sports analyst, said the review had gone beyond VAR’s intended reach. “Surely, this is not within VAR’s realm to review this,” he said on air. Zico, whose disallowed goal started the whole argument, said afterward that the trophy seemed “directed towards Argentina.” Football analyst Ali El Garni offered a cooler take: “Robbed might be a strong word.”

Three specific moments kept the argument alive long after the final whistle:

• Zico’s 58th minute goal was ruled out for Attia’s foul on Martínez, a challenge that unfolded a full pitch away from where the ball ended up.
• A similar shirt pull on Mohamed Salah later in the match went to no review at all, former striker Ian Wright pointed out on air.
• Hamdy Fathy’s penalty appeal, moments before Fernández’s winner, was waved away without a VAR check.

By the end of the week, the main parties had staked out clear positions.

None of that officiating debate explains why someone broke into a federation’s email account four days later. That part of the story starts with a login screen, not a scoreboard.

What Data Did the Hackers Actually Take?

Reports disagree on how deep the breach went. Several outlets said the intruders reached parts of AFA’s own database, exposing journalists’ email addresses, passwords and IP addresses, and that a hacking group later offered pieces of that data for sale on forums. AFA itself has confirmed something narrower than that.

One outlet, TheHackerWire, reported that attackers also reached AFA Medios, the database the federation uses to handle media accreditation and communications for accredited journalists. That specific claim has not been independently confirmed elsewhere.

Daily Sabah, citing other reports, said an Egyptian hacker group claimed responsibility on online forums and allegedly offered portions of the stolen database for sale. No buyer, price or sample of that data has surfaced publicly.

• AFA Medios, the media accreditation database, is the system reportedly reached beyond the single email account.
• Passwords and IP addresses reportedly sat alongside journalists’ email addresses in the exposed data.
• One account is the scope AFA has publicly confirmed, a far narrower claim than the database reports.
• Zero arrests or confirmed identities have been tied to the hacking group so far.

A hijacked inbox sending angry emails is embarrassing for a few news cycles. A federation’s credential database sitting on a hacking forum, if the claims hold up, is a problem that outlasts one World Cup upset.

Football’s Newest Soft Target

Sports federations make unusually soft targets. They sit on large media databases, run IT teams sized for a normal year rather than a World Cup, and become a global flashpoint for a few weeks every four years.

Outlets covering the breach, including Daily Sabah and DigitalShield, a Spanish cybersecurity publication, flagged the same pattern. Major tournaments draw hacktivist attention because of the emotion and the audience attached to them, not because federations run worse security than other institutions.

This is not the only scrutiny the federation is under this month. Separate from the hack, the FBI and federal prosecutors have reportedly been examining roughly $300 million that moved through AFA linked accounts at five U.S. banks, tied to a Florida company that manages the federation’s overseas sponsorship deals. No charges have been filed, and nothing publicly ties that inquiry to the hacked emails.

The Database Questions Outlast AFA’s Reassurance

DigitalShield reported that AFA said the breach affected only one email account. That is a narrower claim than the database, password and IP address reports circulating in Argentine and Uruguayan media that same week. Both versions cannot be fully right.

What We Know:

• AFA confirmed unauthorized emails went out from one of its institutional accounts, carrying the subject line “SYSTEM HACKED: UNFAIR DECISION.”
• The messages reached accredited journalists, including at The Athletic, and were signed by a group calling itself All Egyptian Cyber Warriors.
• AFA said by Friday that the situation had been resolved, three days after the match.

What’s Unconfirmed:

• The real identity or nationality of the hackers, described in reports only as believed to be of Egyptian origin.
• Whether the breach reached beyond the single account AFA acknowledged into the wider AFA Medios database.
• Whether any stolen credentials have actually changed hands, despite claims posted on hacking forums.

AFA closed its file on Friday. Whether the passwords supposedly sitting in a hacking forum are real is a question nobody outside All Egyptian Cyber Warriors has answered yet.

Frequently Asked Questions

Was AFA’s Social Media Also Hacked?

No verified evidence has emerged of a breach beyond AFA’s email system. The confirmed intrusion hit the institutional email servers used by the federation’s media department, and there has been no confirmation that AFA’s official X account, formerly Twitter, was ever compromised.

Who Are the All Egyptian Cyber Warriors?

All Egyptian Cyber Warriors is the name signed at the bottom of the hacked emails. No outlet has independently verified the group’s real world identity or membership. It is known only through the messages themselves and through forum posts claiming credit for the breach.

What Should Journalists Do If They Received the Email?

AFA has asked anyone who received an unusual message from its account to disregard it, especially messages containing links, attachments or requests for personal information. The federation said its systems team was still verifying the scope of the incident.

Could Egypt’s Complaint Change the Match Result?

It is unlikely. FIFA’s chief refereeing officer has already defended the officiating publicly, and a post-match complaint of this kind typically leads to review of future officiating assignments rather than any change to a completed result. Argentina had already advanced to the quarterfinals by the time the complaint was filed.