A study conducted by cybersecurity company Proofpoint unveiled alarming vulnerabilities, with two-thirds of official partners exposed to the risk of email fraud. 

Furthermore, significant gaps in protection measures have been identified among local authorities, ticketing platforms, and travel booking websites, posing potential threats to the public.

According to Proofpoint, cyber-criminals are adept at exploiting major global events, to which the upcoming Olympics are no exception. The allure of the events often allow perpetrators to employ social engineering tactics, posing as official entities to deceive spectators. 

As the countdown to the Paris Games intensifies, securing the entire ecosystem against such threats, particularly email fraud, has become imperative, says Proofpoint. Its analysis focused on the adoption of the email protection protocol DMARC (Domain-based Message Authentication, Reporting, and Conformance).

The study found that among the 77 official partners, only 34% actively protected their domain names with the highest level DMARC registration, leaving a whopping 66% vulnerable to email fraud. 

In addition, out of the 20 cities hosting events, only 30% have implemented the strongest DMARC ‘reject’ registration for their official website domain names. Ticket resale platforms had similar vulnerabilities, with 80% having a DMARC record but only 10% actively protecting their domain names in ‘reject’ mode.

While travel platforms demonstrate greater maturity in defences, with 60% actively protecting their domain names in ‘reject’ mode, 40% remain exposed due to the absence of adequate DMARC protocols.

Recommended reading

• FBI Urges Vigilance Against 2022 Winter Olympics Cyber-attacks
• Security Vendor Finds Malware Hidden in YouTube Descriptions
• Calls to Cyber and Fraud Centre Helpline More Than Doubled Last Year

“It is worrying to see that a majority of players in the Olympic Games ecosystem are still lagging behind when it comes to protecting their emails, a few months before the start of the Opening Ceremony. DMARC is a simple-to-implement and highly-effective measure against domain name spoofing that underpins email fraud. The fact that many organisations still do not have it in place raises fears of the advent of a cyber threat of unprecedented proportions,” said Loïc Guézo, director of cybersecurity strategy at Proofpoint.

“In addition, it’s important for potential spectators to remember that tickets for the Games can only be purchased through the official Games website, which is fully DMARC compliant and proactively blocking fraudulent emails from reaching the public.”

In light of these revelations, spectators are urged to exercise heightened vigilance and adopt precautionary measures such as exercise caution regarding unsolicited communications, particularly those urging urgent action or soliciting payments.

It also suggests to refrain from disclosing financial information or passwords via email or text messages; verify the legitimacy of requests by contacting relevant institutions directly, as well as strengthen online account security by creating unique, complex passwords and enabling multi-factor authentication wherever possible.