Security firm Hudson Rock said an infostealer infection that began on September 8, 2025, on a software developer’s device within the Argentine Football Association (AFA) could have enabled attackers to access internal systems. Egypt’s coach and association criticized refereeing decisions after Argentina eliminated Egypt from the World Cup round of 16. The breach was discovered after mass emails were sent from AFA domains stating that Argentina “stole” the win and that “the robbery will not go unnoticed.” Hudson Rock identified the compromised machine in its database the following day and linked the credentials to an attack claimed by the group All Egyptian Cyber Warriors. The stolen credentials provided access to phpMyAdmin panels, database administration rights, the training headquarters portal, the media portal, and the competition management system. Researchers noted that weak, reusable passwords were present across several internal services, and that some plaintext passwords were found among hashed ones. Forum posts advertised the data, which included staff email addresses, phone numbers, roles, registration timestamps and access to subdomains. The AFA confirmed it is investigating the incident with its IT team and has not yet determined the extent of the breach.