Pro-Iranian Hacktivist Group Cyber Fattah Leaks Sensitive Data from Saudi Games 2024

Key takeaways

• Hacktivist claims should be verified before they are repeated.
• Leaked personal data raises phishing risk for those named.
• Event organisers should limit data collected.

Table of Contents

• Who is Cyber Fattah?
• How the Breach Occurred
• What Are the Types of Leaked Data?
• Geopolitical and Ideological Implications
• Middle East Hacktivism on the Rise
• The Strategic Use of Leaks
• What Is the Role of Cross-Border Cyber Collaboration?
• Saudi Arabia’s Cybersecurity Challenges
• Why Are Sports and Social Events High-Value Targets?
• Conclusion
•  Frequently Asked Questions (FAQs)

Cyber threats in the Middle East have taken a more dangerous turn following the recent cyberattack on the Saudi Games 2024. A pro-Iranian hacktivist group named Cyber Fattah claimed responsibility for leaking thousands of sensitive personal records belonging to athletes, government officials, and visitors. This high-profile data breach highlights how hacktivism is now being weaponized as part of ongoing regional and ideological cyber warfare.

Who is Cyber Fattah?

Cyber Fattah describes itself as an Iranian-aligned cyber team that engages in politically motivated hacking operations. The group is known for targeting Israeli and Western organizations and now seems to be extending its reach to Saudi and U.S. entities. They primarily disseminate leaks via Telegram and underground forums, aligning themselves with Iran's broader cyber strategy.

How the Breach Occurred

According to cybersecurity firm Resecurity, the hackers gained unauthorized access to phpMyAdmin, a common web-based MySQL administration tool. From there, they exfiltrated SQL database dumps, which were then leaked online. The stolen data appears to have originated from the official Saudi Games 2024 website.

The database dumps were first shared on DarkForums, a known cybercrime marketplace, under the alias ZeroDayX, a burner profile likely created to promote the leak and protect the real identities behind the operation.

What Are the Types of Leaked Data?

The leaked records were extensive and highly sensitive, including:

• Passport and ID card scans

• Bank account statements

• Athletes’ medical forms

• Government officials’ email addresses

• IT staff login credentials

• Visitor information and registration data

Such a breach violates individual privacy and also poses a national security risk by exposing identities linked to key infrastructure and decision-making bodies.

Geopolitical and Ideological Implications

This incident is part of a growing wave of cyber offensives rooted in political ideology. The Saudi Games leak is a digital extension of the real-world geopolitical rift between Iran, Israel, and Saudi Arabia.

Hacktivist group Cyber Fattah has previously collaborated with Iran-linked groups like 313 Team, which claimed responsibility for a DDoS attack on Truth Social in response to U.S. airstrikes on Iranian nuclear facilities.

Middle East Hacktivism on the Rise

According to Cyberknow and other threat intelligence platforms, over 119 hacktivist groups have recently been involved in cyber activity across the Middle East. These include:

• Pro-Israel groups like Predatory Sparrow, known for leaking data from Iran's Ministry of Communications and crypto exchange Nobitex.

• Pro-Palestinian groups like the Handala team, targeting Israeli firms since June 2025.

• Pro-Russian-aligned groups like DieNet, which mixes pro-Hamas messaging with Eastern European cyber tactics.

The Strategic Use of Leaks

What makes the Saudi Games attack especially alarming is the strategic intent behind the data leak. According to Resecurity, this wasn’t a financially driven ransomware operation, it was an ideological message. The group intentionally targeted a major social and sporting event to maximize the psychological impact.

Rather than sell the stolen data, the group publicly dumped it to inflict reputational damage and sow distrust in the Saudi government’s ability to safeguard its digital assets.

What Is the Role of Cross-Border Cyber Collaboration?

One of the most concerning aspects of this breach is the growing cross-regional collaboration among threat actors. Groups like DieNet show how language, location, or even political alignment no longer restrict cyber alliances. Instead, shared objectives override geographic boundaries.

DieNet, for instance, operates with a hybrid identity, its members often communicate in Russian, despite espousing pro-Iranian views. This fusion of resources enhances the technical capacity and operational range of such hacktivist operations.

Saudi Arabia’s Cybersecurity Challenges

The breach is a wake-up call for the Kingdom of Saudi Arabia, especially as it hosts more global events and invests heavily in technology. With the rise of Initial Access Brokers (IABs) and persistent threat actors targeting public-facing platforms, enhanced endpoint security, network segmentation, and cloud monitoring are becoming critical.

Why Are Sports and Social Events High-Value Targets?

Events like the Saudi Games draw international attention, making them ideal targets for information warfare. Beyond just personal data, hackers aim to:

• Undermine public trust

• Embarrass national governments

• Spread disinformation and propaganda

• Gain bargaining power in geopolitical disputes

Conclusion

The attack by Cyber Fattah shows the blurring lines between hacktivism and cyber warfare. The cyberattack on the Saudi Games was also a message: it illustrates how deeply cyber tools have been embedded into modern geopolitical playbooks. For governments, organizations, and cybersecurity professionals, this incident reiterates the need for cyber resilience, proactive threat intelligence, and regional cooperation.

Related reading

• How Hacktivist Groups Gain Attention and Select Targets | Modern Hacktivist Strategies Explained
• Cyberattacks on Indian Defence-Linked Websites Thwarted by Cybersecurity Experts Amid Rising Cross-Border Tensions
• Iran-Linked Hackers May Target U.S. Firms & Infrastructure in 2026 | Government Warning