World Cup 2034 infrastructure project targeted by Wallstreet ransomware group

• Ransomware group: Wallstreet
• Country: Saudi Arabia
• Announcement date: October 3, 2026

Wallstreet claims breach of World Cup 2034 infrastructure consortium

The ransomware group known as Wallstreet has claimed responsibility for a significant data breach targeting a consortium involved in the construction of the Jeddah Central Stadium for the 2034 FIFA World Cup. According to an announcement made on a leak site on October 3, 2026, the group asserts that they have successfully compromised the networks of key entities involved in this major infrastructure project.

The threat actor claims to have gained unauthorized access to the networks belonging to the China Railway Construction Corporation (CRCC) Saudi Branch and the Sama Construction consortium. The group alleges that the breach occurred on October 3, 2026, and resulted in the exfiltration of a massive volume of information. Specifically, the group claims that 17 TB of data, comprising approximately 1.5 million files, has been stolen from the targeted organizations.

Details of the alleged data exfiltration

While the group has not provided any screenshots to verify their claims, the volume and variety of the allegedly stolen information are substantial. The group asserts that the stolen data contains sensitive documentation critical to the stadium's development and the commercial operations of the involved parties. The information reportedly includes:

• Contract documents
• Payment certificates
• Claim records
• Personal employee data
• Design documentation
• Commercial data

The scope of the personal data is particularly notable, with the group claiming that the records include the personal information of over 150,000 employees. Furthermore, the breach allegedly involves IFC design documentation for the stadium, as well as various commercial records related to suppliers and subcontractors.

The targeted organization profile

The breach reportedly impacts the operations of the China Railway Construction Corporation (CRCC) Saudi Branch. CRCC is a major Chinese state-owned construction and engineering company. Its operations in Saudi Arabia serve as a main contractor for large-scale infrastructure projects, including the development of the Jeddah Central Stadium, which is a key component of the upcoming 2034 FIFA World Cup preparations.

Potential impacts and security implications

The nature and scale of the data allegedly stolen could lead to significant negative consequences for the organizations involved. The exposure of such a vast amount of sensitive information may impact the operational continuity and the commercial reputation of the consortium. Specifically, the disclosure of personal data belonging to more than 150,000 employees introduces severe risks, including potential identity theft and the possibility of highly targeted phishing attacks against the workforce.

From a regulatory perspective, the organization may face legal sanctions under the data protection regulations established in Saudi Arabia. Additionally, cyberattacks targeting large-scale infrastructure projects can introduce secondary risks regarding the security of the broader supply chain. If the Wallstreet group employs a double-extortion strategy—a common tactic where attackers both encrypt data and threaten to leak it to increase pressure—a ransom demand might be issued to prevent the public release of the stolen files.

In general, organizations operating in high-stakes infrastructure sectors often face increased scrutiny and sophisticated threats. To mitigate such risks, industry experts typically recommend robust defensive measures. These include implementing strict access controls, maintaining comprehensive network monitoring to detect unauthorized exfiltration, and ensuring rigorous security protocols across the entire supply chain. Regular audits of third-party vendor access and the implementation of multi-factor authentication are also standard practices to defend against the types of unauthorized network access claimed in this incident.