A significant data breach involving thousands of personal records from the Saudi Games, one of the largest national sporting events in Saudi Arabia, was recently disclosed. The breach is attributed to a pro-Iranian hacktivist group known as Cyber Fattah, which announced the leak on June 22, 2025, via its official Telegram channel. The stolen data was published as SQL dumps after unauthorized access to the phpMyAdmin backend of the Saudi Games 2024 registration platform.
The leaked data includes highly sensitive information such as IT staff credentials, government official email addresses, athletes’ and visitors’ personal details, passport and ID card scans, bank statements, medical forms, and other scanned sensitive documents. The breach is considered part of a broader information operation by Iran and its proxies, aimed at advancing anti-U.S., anti-Israel, and anti-Saudi narratives in cyberspace, particularly by targeting major sports and social events.
Cyber Fattah is on a roll
Cyber Fattah, which calls itself the “Iranian cyber team,” has a history of targeting Israeli and Western web resources and government agencies. The group is known to collaborate with other threat actors in the region and is part of a broader alliance called the “Holy League,” which targets Israel and, more recently, has expanded its focus to include the U.S. and Saudi Arabia. The leak was distributed on the dark web by a user identified as “ZeroDayX,” a burner profile likely created specifically for this incident to obscure direct attribution.
The breach was announced shortly after distributed denial-of-service (DDoS) attacks on the U.S. social media platform Truth Social, following U.S. airstrikes on Iranian nuclear facilities. Analysts believe the timing and targeting of the Saudi Games are strategic, intended to undermine Saudi Arabia’s international reputation and to amplify geopolitical tensions in the region. The incident has been amplified by Hezbollah-linked, Hamas-linked, and pro-Iranian groups across digital media channels.
