Iran-linked Handala Claims FBI Drone Breach, Threatens World Cup

Handala, a hacking group linked to Iran, posted that it accessed surveillance footage from drones operating near 2026 FIFA World Cup sites. The group claimed the footage included facial-recognition and license-plate images and covered several months.

In a post the group warned: ‘Better tighten your World Cup security, we don’t like some of those teams at all,’ and added that first-person view drones ‘are everywhere; you never know when one might end up right in your team’s bus.’

A monitoring organization that tracks online threats reported the claim. Researchers who examined materials released by Handala identified inconsistencies. One video offered as proof matched content produced in December 2024 by a software company demonstrating technology used by a U.S. police department for tornado damage assessment. The larger set of claims has not been independently verified.

U.S. authorities have linked Handala to Iran’s Ministry of Intelligence and Security. The Department of Justice describes the group as involved in data theft, destructive ‘wiper’ malware attacks, and online influence operations that use stolen data, threats and publicity to pressure targets. Earlier this year the group claimed it accessed an FBI official’s personal email and posted photos and other material online. Handala has also taken credit for a breach of California Water Service, posting roughly five gigabytes of allegedly stolen customer and company data.

U.S. officials have not publicly confirmed that FBI drone systems were compromised. The FBI and other agencies typically do not comment on ongoing cyber investigations. Law enforcement and event security teams are expected to review the group’s assertions and adjust protective measures for venues, teams and fans as needed.

The State Department’s Rewards for Justice program continues to offer up to $10 million for information that helps identify foreign government-directed hackers involved in attacks on U.S. critical infrastructure. Researchers note claims by hacking groups can combine real breaches, exaggeration and repurposed material, and require outside verification.