New research tied to the 2026 World Cup found cybercriminals selling compromised streaming accounts at scale, highlighting an enterprise risk pattern that education IT leaders increasingly face with credential theft. HUMAN Security’s Satori Threat Intelligence reported more than 12 million compromised accounts tied to World Cup streaming services, representing nearly $220 million in estimated black-market sales. The findings describe threat actors increasing both the number of accounts and prices as demand rises, with a record release of 802,000 compromised accounts on June 27. The report frames the tournament as a high-demand event that criminals treat like other lucrative seasonal spikes. Campus IT teams focused on learning platforms, SSO, and proctored or media-heavy applications can draw a direct operational takeaway: credential protection and monitoring must keep pace with rapidly shifting demand signals and stolen-account resale markets.