By Mark Freedman
The 2026 FIFA World Cup will be the largest sporting event ever hosted in the United States. More than 100 matches will be played across 11 U.S. cities, alongside venues in Canada and Mexico, with total attendance expected to exceed six million spectators and billions more watching globally.
The scale at which the FIFA World Cup is about to be unleashed on the world makes the tournament uniquely visible. Historically, events of this magnitude have attracted terrorists, extremists, and hostile state actors because they combine dense crowds, predictable schedules, and continuous global media coverage. As preparations accelerate for 2026, it is worth revisiting how past attacks unfolded, who carried them out, and the tactics they used.
On September 5, 1972, eight members of Black September, a Palestinian terrorist organization, infiltrated the Olympic Village in Munich, Germany by climbing a perimeter fence. They were armed with rifles and grenades. The attackers entered the Israeli team’s quarters and took 11 members of the team hostage.
Negotiations between the terrorists and German authorities played out over the course of the day and were broadcast live to a global audience. A rescue attempt by German authorities later that night at Fürstenfeldbruck airbase failed, and Black September killed all 11 hostages in the process.
The Munich attacks are remembered as a watershed moment in global terrorism, when brutal violence and modern media coalesced to amplify the terrorists’ motives and grievances to the world.
More than twenty years later, on July 27, 1996, another Olympics was attacked. Eric Robert Rudolph, a white supremacist extremist, detonated a pipe bomb in Centennial Olympic Park during the Atlanta Summer Olympics.
The device was concealed in a military-style backpack and packed with nails to maximize shrapnel injuries. Two people were killed, and 111 others were wounded. A 911 call came in shortly before the explosion and led to a partial evacuation, which likely prevented the casualties from being much higher.
The Atlanta bombing occurred a year after the Oklahoma City bombing, perpetrated by another far-right extremist, the infamous Timothy McVeigh.
On April 15, 2013, two improvised explosive devices detonated near the finish line of the Boston Marathon. The bombs were pressure cookers filled with explosive powder, nails, and ball bearings, concealed in backpacks and detonated remotely.
The near-simultaneous explosions were a hallmark of al-Qa’ida and jihadist bombing tactics at the time. The attack killed three spectators and injured more than 500 others. The perpetrators, brothers Tamerlan and Dzhokhar Tsarnaev, had radicalized after consuming online jihadist propaganda.
The Boston Marathon bombing, while not one of the deadliest terrorist attacks on U.S. soil, had a significant psychological impact on Boston and the country due to the nature of the target, the high number of gruesome injuries (specifically more than a dozen amputations), and the highly publicized manhunt that unfolded across Boston and the surrounding areas in the following days.
On November 13, 2015, ISIS terrorists launched coordinated attacks across Paris. The first attack targeted the Stade de France during a soccer match between France and Germany. A routine security check prevented the ISIS operative, who was armed with a suicide vest, from entering the stadium. He detonated the vest outside, killing himself and one civilian. The damage could have been far worse if he had been admitted to the stadium.
As a result of successful security intervention, the interdicted Stade de France attack is greatly overshadowed by ISIS’s successful attack the same night on the Bataclan concert hall, a small arms attack by a group of ISIS assailants that killed 90 and injured more than 100.
Altogether the ISIS attacks on Paris in November 2015 killed 130 people. It also heralded a wave of ISIS “external operations” terrorist attacks that would continue across Europe through the following year.
The start of the 2024 Paris Olympics was disrupted by a coordinated sabotage attack on the French high-speed rail that was critical to ferrying spectators to the events. The attack, which involved arson and cable theft, left no casualties but caused mass confusion, uncertainty, and fear heading into the Games.
Unlike the previous attacks discussed here, it is suspected by many that the Paris Olympics sabotage was not the work of a non-state terrorist group but rather could be that of the Russian intelligence services. This incident exemplifies the growing risk that state actors will engage in gray-zone tactics to disrupt sporting events held in countries with which they have geopolitical disagreements. For security teams, it widens the aperture of threat actors to be concerned about.
Clearly, there is strong precedent for terrorist attacks and sabotage targeting events like the 2026 World Cup. What’s more, the threat environment five months out from event commencement is highly complex and volatile - marked by a combination of foreign terrorist threats, domestic violent extremism, civil unrest, assassinations, foreign intelligence operations, and cyber-attacks.
In this context, corporate security and intelligence teams – even those with little direct exposure to the World Cup – will need to consider the increased risks created by this major sporting event. Those risks include high-publicity matches taking place across multiple metropolitan areas, influxes of large crowds, increased use of mass transportation and air travel, heightened security attention from federal, state, and local agencies, and global broadcast of the activities.
Establishing and continually refining a strong intelligence picture will be crucial for security teams in the next several months. Intelligence analysts should think strategically (what is the full range of threats and risks that the World Cup could generate?), operationally (how is this likely to impact our company?), and tactically (what specifically could happen and how can we mitigate?) to adequately prepare for this major event.