Argentina Squad Data Breach

How 26 Passport Numbers Ended Up in the Press Kit

The breach came down to one critical failure by "Road to '26," the third-party logistics firm hired to run match-day operations in Alabama. The firm emailed a digital PDF of the official team roster to its media distribution list at 4:15 p.m. local time. A column showing full passport numbers — meant only for internal travel and visa documents — was never removed. By 4:40 p.m., a local blogger had posted a high-resolution photo of the sheet on X. Followers immediately spotted the exposed data.

A spokesperson for "Road to '26" called it "a clerical error" in which "a restricted internal spreadsheet column" was included in the public media packet. The Argentine Football Association (AFA) confirmed the breach in a statement, calling it "an unacceptable breach of trust." AFA President Claudio Tapia said the federation was working with cybersecurity experts to monitor for any fraudulent use of the data. Notably, Iceland's roster — submitted through a separate internal channel — had no passport numbers visible at all, Dubai Eye reported.

1 source

Messi, Mac Allister, Álvarez: The Names on the Leaked Sheet

The exposed document included passport details for 26 players, 14 coaching staff, and 3 senior AFA executives, according to the investigative report shared with World Cup organizing officials. Reuters confirmed that Premier League stars Alexis Mac Allister, Enzo Fernández, and Lisandro Martínez were among those named. Julián Álvarez — widely reported as a Real Madrid transfer target — was also on the sheet. His travel documents being public could complicate transfer logistics, analysts warned.

The unredacted image racked up an estimated 1.2 million impressions on social media within 30 minutes of the first post. NE Herald reported that local media shared the image before being asked to delete it after an urgent recall email went out at 5:45 p.m. Cybersecurity expert Sarah Jenkins told The New York Times that a passport number for someone like Messi is "a high-value asset on the dark web" that can be used for identity fraud or to track the travel movements of high-profile individuals.

1 source

Messi Returns from Injury, Scores Penalty in 3-0 Win

Despite the chaos off the pitch, Argentina put in a commanding performance. Messi, returning from a hamstring injury, came on as a substitute in the 70th minute. Just four minutes later, he stepped up to convert a penalty. Thiago Almada added a third goal in the 88th minute to seal the result. The sell-out crowd of 88,412 — one of the largest ever to watch Argentina in the United States — barely noticed the controversy swirling in the press area, SE Daily noted.

1 source

Passport Replacements, Lawsuits, and World Cup Scrutiny Ahead

The AFA is now considering emergency passport replacements for all affected players before they travel to their next camp in Miami. Legal experts expect the players' union FIFPRO to pursue a privacy lawsuit against "Road to '26." EU-based players like Mac Allister and Fernández may also have grounds for a complaint under GDPR — the EU's strict data privacy law — which could result in heavy fines if investigators find "gross negligence," ARN News Centre reported.

FIFA has not yet commented publicly, but an anonymous FIFA representative said the "operational failure" raises concerns about the full 48-team tournament. International sports media have not been kind. Critics argue that if a basic roster cannot be handled securely for a single friendly, the complex logistics of the World Cup are at risk. "Road to '26" could lose its remaining pre-tournament contracts as a result.

1 source