It’s that time of year once again…March Madness! The official kickoff starts with Selection Sunday this weekend and the beginning of the NCAA Tournament next Tuesday, March 18.
March Madness is one of the largest, most watched, and most anticipated, sporting events every year here in the US. What makes it most intriguing is that it’s the only major sporting event in the US that traditionally falls during our business day and those who participate in viewing, and playing in their “office pools”, are leaving their organization susceptible to a variety of security threats.
As millions of fans gear up for the NCAA Tournament, cybercriminals are preparing for their own version of March Madness-exploiting security gaps during high-traffic events. The increased interest from users and the dramatic spike in emails, links and other communications related to the event make it much easier to blend in. Cybercriminals often impersonate event organizers, popular brands, or even athletes to deceive users into revealing personal information. For instance, fans might receive emails or messages claiming they’ve won tickets or exclusive merchandise, prompting them to click on malicious links or provide sensitive data.
The excitement that employees have surrounding large events, like March Madness, can lead individuals to download unauthorized streaming applications or visit unverified websites, inadvertently installing malware or ransomware. These malicious programs can compromise personal data or lock users out of their systems until a ransom is paid. Additionally, cybercriminals can create counterfeit apps or websites that mimic legitimate sources, offering schedules, live scores, or streaming services. Unsuspecting users who download or access these platforms risk having their personal information harvested or their devices infected.
The demand for information, combined with the massive audience, also mean that the odds of an attack’s success are significantly higher. In fact, with the rise of AI technology, cyber-attacks are becoming more sophisticated and frequent. Cybercriminals may target corporate networks, leveraging the heightened interest in the tournament to launch sophisticated phishing attacks, malware campaigns, and other cyber threats. By infiltrating company systems, hackers can steal sensitive data, disrupt operations, and inflict substantial financial damage. Some March Madness studies have shown that the potential cost of AI hacking during March Madness to businesses could reach nearly $20B. This figure encompasses direct financial losses, regulatory penalties, reputational damage, and the costs associated with cybersecurity measures and incident response efforts.
Here is what cybersecurity industry experts are recommending ahead of this year’s tournament:
++
J Stephen Kowski, Field CTO at Pleasanton, Calif.-based SlashNext Email Security+
March Madness brings heightened cybersecurity risks this year, especially with the expansion of sports gambling beyond traditional office pools creating new attack vectors for credential harvesting and financial fraud. Attackers are crafting convincing phishing campaigns that mimic tournament brackets, betting promotions, and registration forms-all designed to steal credentials or connect to funding sources. Modern email security with real-time phishing detection can identify these threats at the point of click, protecting users whether they’re participating in office pools or exploring betting platforms. The intersection of a major sporting event during business hours, with increased personal financial stakes, creates a perfect opportunity for sophisticated social engineering attacks that blend seamlessly with legitimate tournament communications.
++
Krishna Vishnubhotla, Vice President, Threat Intelligence at Zimperium, a Dallas, Texas provider of mobile security solutions
March Madness creates a perfect storm for mobile-targeted cyber threats. From phishing scams to fake bracket apps, cybercriminals exploit the surge in activity to steal credentials and compromise devices. Organizations must ensure their mobile security strategy includes proactive, on-device protection that detects and stops threats before damage is done.
Cybercriminals know employees will be streaming games, checking brackets, and engaging on mobile devices during March Madness. Fake betting apps, fraudulent login pages, and malicious streaming links can easily bypass traditional security layers. Enterprises must take a mobile-first approach to security, ensuring threats are detected in real-time before they impact users or corporate networks. With employees engaging in March Madness activities on mobile devices, security blind spots increase. Cybercriminals take advantage of this with phishing attacks, fake apps, and malicious links that traditional security solutions often miss. Businesses should implement mobile security that continuously monitors for threats-on and offline-to keep both devices and corporate data safe.
++
Chris Gray, Field CTO at Deepwatch, a San Francisco, Calif.-based AI+Human Cyber Resilience Platform
This scenario follows the common phishing tactics – strike at personal interest. End users know not to trust random emails. We know that no Nigerian prince is actually going to give us millions. We understand that unsolicited requests from our bank may be falsely presented. Each of these, however, address something we care about: fear, greed, self-interest, a lack of time, etc. The end result is that phishing remains one of the most effective sources of compromise in play.
The March Madness concerns fall into the same category. Mass interest equal mass opportunity, and familiarity breeds contempt. Organizations (and end users in general) need to invest in awareness training and protection, be it agents, system policies, or preventative gateway controls, in order to minimize damage. Monitoring of credit, dark web activity, and other associated remote access means can help identify potential harm if the door was already left open.
In short, all of the normal phishing protections and practices should be in place, updated as needed, and well communicated. This is an exciting time, but it doesn’t excuse us from properly cyber hygiene.
++
Trey Ford, Chief Information Security Officer at Bugcrowd, a San Francisco, Calif.-based leader in crowdsourced cybersecurity
The same advice rings true for March Madness as it does any other time of the year. If it sounds too good to be true, it probably is…except on the internet where it always is. We all love a good deal, but take care in where you try to make purchases online. Buying from reputed sources (whether tickets, merchandise, or anything else) is the only way to avoid credit card theft and counterfeit products.
I believe that most people have learned not to enter credit cards into shady websites, and we should all think twice before giving away our email address and cell phone numbers. Please never, EVER install applications after clicking an advertising link, especially when it came from trying to buy tickets or sports merchandise. Most of this fraud should clearly take place outside of the workplace – ultimately we should all avoid conducting personal business on our work accounts.
++
Kaushik Devireddy, Senior Product Manager at Deepwatch, a San Francisco, Calif.-based AI+Human Cyber Resilience Platform
Betting and sports websites such as DraftKings, FanDuel, etc. rely heavily on engaging users through promotional offers such as Bonus Bets. These provide users a risk-free bet, or discounted odds on popular odds lines. We can expect that as March Madness ramps up, threat actors will craft phishing emails and notifications for bonus bets impersonating betting platforms with the imagery/likeness of March Madness players. Their goal with these attacks will be to gain access to betting accounts which contain deposited funds, as well as bank account linkages. While the method to exfiltrate funds for threat actors is not obvious (many betting platforms have strong verification procedures for withdrawals), they can certainly cause users harm by wasting deposited funds.
##
