Threat actors are actively exploiting the FIFA 2026 World Cup’s tri-national footprint to run phishing, fraud, DDoS, and adversary-in-the-middle campaigns targeting enterprises with staff traveling to US, Canada, and Mexico host cities. The jurisdictional complexity of three distinct regulatory regimes (US state privacy laws, PIPEDA, LFPDPPP) creates a response coordination burden that threat actors exploit by timing breaches to the event window when security teams are stretched.