The personal information of some 250,000 fans who attended the 2006 World Cup in Germany may have been stolen and sold on the black market for more than $750,000, according to reports in the Norwegian and British media.
The information was reportedly stolen from a database compiled by the International Federation of Association Football (FIFA), soccer's global governing authority, to facilitate ticket sales through official FIFA outlets.
The mammoth data breach was first reported in the Norwegian newspaper Dagbladet, which said the personal details of 50,000 Norwegian and Swedish fans – including former Swedish Prime Minister Ingvar Carlsson and former Minister of Integration Jens Orback – were being peddled to the highest bidder.
According to the Daily Mail, the database contained sensitive information including names, dates of birth and passport numbers of World Cup fans including 35,000 Englishmen, 36,000 Swiss, 42,000 Portuguese, 36,000 Dutchmen, 20,000 Americans, 50,000 Scandinavians and tens of thousands Poles, Italians, Germans, Frenchmen, Spaniards and Croatians.
The data breach, which may leave a quarter of a million soccer fans vulnerable to identity theft and fraud, is the subject of a criminal investigation amid fears the information may have been sold to criminal gangs or possibly terrorist groups.
Britain's data watchdog, the Information Commissioner's Office (ICO), also launched an inquiry, and is trying to determine why the database was not deleted after the 2006 World Cup, in accordance with international laws governing the exchange of sensitive information.
"We have been made aware that the personal details of some 35,689 England fans have been unlawfully traded for profit," said Mick Gorrill, head of enforcement at the ICO. "We have contacted FIFA regarding the allegations and will be liaising with the organization further as we move forward with an investigation."
FIFA refused to comment on the case, while the ICO said its initial investigation indicated the number of compromised English fans may only number some 7,200, which may include Prince William of England.
A report in the Guardian suggests it may have been an inside job, with authorities looking into allegations by Dagbladet that the data was stolen by an employee of Match Hospitality, FIFA's official ticketing agency. Dagbladet said it obtained all 250,000 records, as well as e-mails from a Match employee -- whose identity it claims to have confirmed -- who offered the list for sale to a "major player" on the black market.
Match Hospitality is partly owned by a media company run by Philippe Blatter, nephew of the FIFA president, Sepp Blatter. Jaime Byrom, chairman of Match Event Services and Match Hospitality's biggest shareholder, told Dagbladet the firm was unaware of the theft and sale of the information, but acknowledged an employee may have gained access to the confidential information without the firm's knowledge.
Potential heist of data from 250,000 World Cup fans sparks world probes