Past breach data show over 1.1 million soccer-related passwords
ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
Experts urge to delete any sports references from account logins' details
As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.
In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.
Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.
Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.
"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."
An open goal for cybercriminals
(Image credit: ExpressVPN)
To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.
Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.
Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.
The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.
Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.
"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.
He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."
If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.
Traveling to the 2026 World Cup means joining hundreds of thousands of fans in crowded cities across North America.
Airports, stadiums, fan zones, and hotels are all packed with people competing for the same public Wi-Fi networks. These connections are often slow and insecure, making personal data vulnerable to interception.
To stay protected without sacrificing speed, you need more than just a VPN – you need the best VPN with the right settings. Tuning your VPN configuration helps keep your connection secure and fast, no matter where you go during this summer’s tournament.
The 5 best settings to change for top VPN performance
Just turning on your VPN isn’t always enough to cut through the noise of a packed stadium or busy airport terminal. To get good speeds and real security when thousands of people are online at once, here are five specific settings to tweak:
1. Protocol
WireGuard is the superior protocol choice for modern devices, offering faster connection speeds and lower latency compared to OpenVPN or IKEv2.
This efficiency matters when network congestion is high. WireGuard establishes secure tunnels more quickly, reducing wait times. If your provider offers OpenVPN, it's a great alternative for compatibility, but for raw performance in crowded zones, WireGuard is best.
2. Transport protocol
If you've never heard of transport protocols before, think of them as the delivery method your VPN uses to move data. Most commonly, you'll see TCP and UDP as your choices for this.
On congested networks, TCP’s reliability mechanisms can add delay when packets are lost. UDP avoids this overhead by sending data without waiting for confirmation.
In a crowded stadium where every millisecond counts, switching to UDP can reduce latency and improve responsiveness for smooth VPN streaming even when the network is struggling to keep up.
3. Split tunnelling
With split tunneling, you can choose which apps can be routed outside the VPN’s encrypted tunnel. At a stadium, your banking app needs maximum security, but a local map app might benefit from direct access to avoid unnecessary latency.
Excluding non-sensitive apps from encryption can reduce bandwidth strain and prevent compatibility issues with local networks that sometimes block VPN traffic entirely.
4. Location
Connecting to the server closest to your physical location often results in lower ping and faster speeds. However, nearby servers may be overwhelmed by thousands of users connecting simultaneously.
If your current location lags, try switching to a server slightly further away that’s under less user load. Avoid jumping between regions unnecessarily, as crossing international borders increases the distance data travels and introduces lag that ruins live streaming.
5. Obfuscation
In monitored environments like airports, deep packet inspection can detect and block standard VPN traffic.
Obfuscation disguises VPN traffic as regular HTTPS web traffic, allowing you to bypass firewalls and censorship attempts. Although this adds processing that might marginally impact speed, the ability to stay connected when other connections fail more than makes up for this.
Norton VPN handles 2026 World Cup crowds well. With servers in over two dozen North American cities, it’s designed for high traffic. It features native WireGuard support and built-in obfuscation to bypass congestion and blocks. Plus, a generous 60-day money-back guarantee gives you plenty of risk-free time to test these tweaks.View Deal
As you prepare to cheer on your national team at the 2026 FIFA World Cup, make sure your setup can handle the packed stadiums and busy airports.
By selecting the right VPN protocol, using UDP, and enabling features like split tunneling, you can protect your data and keep your device safe so you can enjoy the World Cup worry-free..
While the UK seeks to copy Australia’s world-first social media ban, evidence suggests that most teens are still using their accounts Down Under without the need to download a VPN app. So, why put every citizens' privacy at risk for an approach that’s proven to be failing?
As the British Prime Minister shared plans to ban all under-16s from social media, speculation is mounting as to whether VPNs will be next. While we wait for the government to share further information on this in July, here's how the debate has been unfolding.
AmneziaVPN Premium users finally have their 20 server locations back online! Plus, the provider is rolling out compensation following a chaotic few weeks of cyberattacks. Here is everything we know so far.
Login
