It’s not often that football and cybersecurity are mentioned in the same sentence. But with endless streams of data being collected by teams to inform their strategies both on and off the pitch, a cybersecurity incident could be catastrophic. The question is: who is top of the football cybersecurity league?

New York-based IT firm SecurityScorecard, which uses AI to rate the cyber hygiene of any company in the world, turned its rating platform towards the footballing world and ranked the teams in order of their cybersecurity posture.

And it found that Brighton & Hove Albion FC has the best defence in the Premier League – at least when it comes to fending off cyberattacks.

While Chelsea currently sits 4th in the league, it does not fare well for its cybersecurity and sits bottom of the rankings.

SecurityScorecard also analysed the cyber hygiene of Germany’s Bundesliga and Spain’s La Liga. And among all three leagues, a similar pattern emerged: the higher the club sits in the league, the worse their cybersecurity posture tends to be.

Southampton FC, for example, languishes near the bottom of the Premier League table but has the third best cybersecurity (league standings accurate as of 1^st December 2018).

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

View profiles in store

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData

Submit

UK USA Afghanistan Åland Islands Albania Algeria American Samoa Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bonaire, Sint Eustatius and Saba Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos Islands Colombia Comoros Congo Democratic Republic of the Congo Cook Islands Costa Rica Côte d"Ivoire Croatia Cuba Curaçao Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Falkland Islands Faroe Islands Fiji Finland France French Guiana French Polynesia French Southern Territories Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guernsey Guinea Guinea-Bissau Guyana Haiti Heard Island and McDonald Islands Holy See Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Isle of Man Israel Italy Jamaica Japan Jersey Jordan Kazakhstan Kenya Kiribati North Korea South Korea Kuwait Kyrgyzstan Lao Latvia Lebanon Lesotho Liberia Libyan Arab Jamahiriya Liechtenstein Lithuania Luxembourg Macao Macedonia, The Former Yugoslav Republic of Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Martinique Mauritania Mauritius Mayotte Mexico Micronesia Moldova Monaco Mongolia Montenegro Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Northern Mariana Islands Norway Oman Pakistan Palau Palestinian Territory Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Poland Portugal Puerto Rico Qatar Réunion Romania Russian Federation Rwanda Saint Helena, Ascension and Tristan da Cunha Saint Kitts and Nevis Saint Lucia Saint Pierre and Miquelon Saint Vincent and The Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Africa South Georgia and The South Sandwich Islands Spain Sri Lanka Sudan Suriname Svalbard and Jan Mayen Swaziland Sweden Switzerland Syrian Arab Republic Taiwan Tajikistan Tanzania Thailand Timor-Leste Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates US Minor Outlying Islands Uruguay Uzbekistan Vanuatu Venezuela Vietnam British Virgin Islands US Virgin Islands Wallis and Futuna Western Sahara Yemen Zambia Zimbabwe Kosovo

Industry * Academia & Education Aerospace, Defense & Security Agriculture Asset Management Automotive Banking & Payments Chemicals Construction Consumer Foodservice Government, trade bodies and NGOs Health & Fitness Hospitals & Healthcare HR, Staffing & Recruitment Insurance Investment Banking Legal Services Management Consulting Marketing & Advertising Media & Publishing Medical Devices Mining Oil & Gas Packaging Pharmaceuticals Power & Utilities Private Equity Real Estate Retail Sport Technology Telecom Transportation & Logistics Travel, Tourism & Hospitality Venture Capital

Tick here to opt out of curated industry news, reports, and event updates from Verdict.

Submit and download

Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

In the Bundesliga, Borussia Dortmund sits top of the footballing league but bottom for its cybersecurity. The same is also true of La Liga’s Sevilla FC.

Why does it matter if a football team has strong cybersecurity?

A few decades ago, it wouldn’t have mattered very much. But today, football teams have increasingly large digital footprints.

“We have so much more data about players,” says Matthew McKenna, VP EMEA at SecurityScorecard and the man behind the research. “Every match is being filmed, all training games are being filmed, all match day games are being filmed.

“We have blood test data, we have fitness level data. There’s just so much critical data now about these players that is at risk of exposure.”

Arsenal, for example, collects around 8 terabytes of data a year from training sessions alone.

Then there’s customer data, such as phone numbers, addresses and payment details. For some of the biggest teams, those databases can contain hundreds of thousands of people.

And with Manchester City’s turnover surpassing half a billion pounds, the 4% fine threatened by GDPR could prove very costly to a team suffering a data breach.

Some of the bigger clubs, such as Manchester United, Arsenal and Juventus are publicly listed companies. A hack like the one on Real Madrid’s Twitter page, which claimed Lionel Messi was headed to Madrid, can send shockwaves through a club’s share price.

Then there’s scouting information and email correspondence, which are both at risk to hacks, that could scupper a multi-million-pound transfer deal.

“There’s a lot of money at stake here for the protection of this data,” says McKenna, who played semi-professional football in both Germany and Finland in the 90s.

To rank the football clubs, SecurityScorecard looked at ten criteria. These include network security, DNS health, application security, patching bands, IT reputation, exposed administrator domains, leaked credentials, social engineering and hacker chatter.

It took all of these factors into account and compared football teams in the English Premier League, German Bundesliga and Spanish La Liga.

Here’s how they stack up:

(All standings accurate as of 01/12/18)

Premier League

La Liga

Bundesliga

Why do bigger clubs tend to fair worse in football cybersecurity rankings?

The findings show that overall, the three football leagues are doing “reasonably okay” when compared to all businesses.

“The concern is with those top teams that have the largest digital footprints out there, that are multi-million dollar a year businesses that probably need to take that little bit more focus on the cyber risk posture because they also have more to lose,” says McKenna.

“They’re the ones taking the majority of the television revenues, the commercial revenues, the media revenues. If I have more to lose, maybe I should consider investing more to protect that.”

But why do the larger teams tend to sit towards the bottom of the football cybersecurity rankings, despite their IT budgets being bigger in outright terms?

One explanation is their larger digital footprints.

“They’re internationalising heavily to build out their brand and as a result they’re also expanding their digital footprint at a global level and they’re leveraging more digitalisation tools as well as they go forward.

“So they have a lot more digital assets and ground to cover and more complexity to the coverage. And with that exposure, maybe they don’t have the same level of cyber maturity that traditional businesses have.”

Another reason is that bigger clubs are more likely to be targetted.

“Some companies with excellent cybersecurity ratings still get breached, because they’re being targetted,” says McKenna. “And some companies with extremely poor cybersecurity ratings will not get breached, because they’re not being targetted. So it’s there to give us a general indication of cyber health.”

Worryingly, regulatory compliance was severely lacking across all three leagues, with both the Bundesliga and La Liga scoring 0% for GDPR compliance.

“Cybersecurity is probably not an extremely day-to-day topic inside professional football teams,” says McKenna.

“They’re worried about winning the next game, what players they’re going to recruit, merchandising, these types of things.

“Cybersecurity is probably not up in their top five, but at the same time, when you start thinking of things like GDPR fines and things like that, it’s potentially a significant amount of money that can impact their business if they don’t take care of the issues from a cyber perspective.”

Read more: Technology in tennis: How data is serving up new insights

Sign up for our daily news round-up!

Give your business an edge with our leading industry insights.

Sign up