1. Executive summary
On 2026-10-03 the ransomware group calling itself Wallstreet listed "World Cup 2034" on its leak site, claiming it compromised the network of the China Railway Construction Corporation Saudi Branch / Sama Construction consortium, the main contractor building the Jeddah Central Stadium for the FIFA World Cup 2034. The group claims 17 TB and 1.5 million files exfiltrated, including main contract documents, interim payment certificates, claims against the owner (Jeddah Central Development Company, PIF), active dispute and suspension claim records, personal data of more than 150,000 employees, IFC design documentation, and supplier and subcontractor bid tabulations. No CVE, exploited component, or initial access vector is given in the source, and no MITRE ATT&CK profile exists for Wallstreet, so the attribution and the technical claims are unconfirmed. The direct exposure to EMEA financial services is indirect but real: the leaked material is project-finance, payment-certificate and personal-data content of the kind that sits in the credit, guarantees and trade-finance files of banks with Gulf construction exposure, and the personal data of 150,000+ employees is a reportable data-protection event for any EMEA entity in the consortium chain. Treat the 17 TB figure and the file inventory as the actor's own claim, not a verified count.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | The victim is a construction consortium whose contract, payment and design data is held by, or shared with, financial entities financing the project. If an EMEA financial entity is a lender, guarantor or insurer on this project, its third-party ICT exposure runs through the contractor's compromised network. | Map whether your institution has a contractual or financing relationship with the named consortium or the Jeddah Central Development Company. If yes, the third-party risk register entry for that relationship needs updating and the incident must be assessed against your own ICT third-party risk policy. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Only engaged if the incident is classified as major for your entity under Art. 18. The leaked personal data of 150,000+ employees and the contract/payment records are the facts that could push an affected financial entity's own incident over the major threshold. | If you are an affected financial entity, run the Art. 18 classification against the leaked data categories. Do not assume the contractor's incident is automatically yours; the trigger is your own exposure to the leaked data. |
| NIS2 Art. 23: incident reporting obligations | Engaged only for in-scope EMEA entities that are themselves affected. The source does not name any EMEA financial entity as a victim. | No reporting obligation is triggered by this item alone. If your entity is later confirmed as an affected party in the consortium chain, the NIS2 Art. 23 clock applies from your own awareness, not from the actor's post. |
No DORA Art. 17, 18, 24, 29 or 30, and no NIS2 Art. 21(2)(d) or UK NIS 2018 duty, is directly engaged by the facts in this item. The item names no EMEA financial entity as a victim, no exploited vulnerability, and no supply-chain compromise of a financial-sector ICT provider.
3. Technical analysis & attack chain
The source is a single ransomware leak-site listing. It contains no initial access vector, no exploited CVE, no malware family, no tooling, no command-and-control detail, and no timeline. What follows is limited to what the actor posted.
- Wallstreet claims it compromised the network of the China Railway Construction Corporation Saudi Branch / Sama Construction consortium.
- The actor claims it exfiltrated 17 TB across 1.5 million files.
- The actor claims the exfiltrated set includes main contract documents, interim payment certificates, claims against the owner (Jeddah Central Development Company, PIF), active dispute and suspension claim records, personal data of 150,000+ employees including Saudi employees, IFC design documentation for the stadium, and supplier and subcontractor commercial data including bid tabulations.
- The actor published the listing on its leak site on 2026-10-03.
That is the full extent of the confirmed sequence. Everything below is either the actor's claim or absent from the source.
What the source does not say. No initial access vector is stated. No CVE is named. No malware, implant, loader, or ransomware binary is named. No persistence mechanism, privilege escalation path, lateral movement technique, or command-and-control infrastructure is described. No ransom demand, negotiation status, or leak deadline is given. No victim confirmation has been published. The 17 TB / 1.5M file figures and the file inventory are the actor's own claims and are single-sourced to the leak-site post; they should be treated as unverified until the victim or a national authority confirms. The claim that personal data of 150,000+ employees is included is the highest-impact claim in the post and is also single-sourced.
Attribution. Wallstreet has no MITRE ATT&CK profile in the verified reference data. The group name is self-assigned on the leak site. There is no corroborating reporting in the provided sources linking this post to a tracked intrusion set, and no technical artefact in the source that would allow independent attribution. Treat the attribution as unconfirmed.
Sector relevance. The victim is a construction consortium, not a financial entity. The relevance to EMEA financial services is through the data categories: interim payment certificates, claims against the owner, dispute and suspension claim records, and bid tabulations are the documents that underpin project finance, performance guarantees, and trade-finance facilities. A bank with exposure to this project should assume those documents may be in the leaked set and should not wait for victim confirmation to check its own file holdings.
4. Mitigation & containment
The source gives no vendor fix, no patch, and no technical indicator to act on. The actions below are therefore about exposure assessment and data-handling, not about closing a named vulnerability.
P1 (within 24h)
- Determine whether your institution is a lender, guarantor, insurer, or counterparty to the China Railway Construction Corporation Saudi Branch / Sama Construction consortium or to Jeddah Central Development Company (PIF). If yes, open an incident record and notify your third-party risk and credit functions.
- Search your own document repositories, deal rooms, and email archives for the document classes named in the post: interim payment certificates, claims against the owner, dispute and suspension claim records, IFC design documentation, bid tabulations. If any are held, treat them as potentially exposed and restrict further sharing.
- If your institution holds personal data of any of the 150,000+ employees referenced, escalate to your DPO. The claim is single-sourced; verify against your own records before any external notification.
- Do not contact the actor. Do not access the leak site from corporate infrastructure.
P2 (within 72h)
- If you are an affected financial entity, run the DORA Art. 18 classification against the leaked data categories and decide whether Art. 19 reporting is engaged. The trigger is your own exposure, not the contractor's.
- Review the ICT third-party risk register entry for any relationship with the named consortium. Confirm whether the contract includes the Art. 30 key contractual provisions on incident notification and data handling. If it does not, that gap is the finding.
- Brief relationship managers and credit officers who hold the project file so they do not act on unverified leak-site claims in client communications.
P3 (within 7 days)
- Add the named consortium and the Jeddah Central Development Company to your third-party monitoring watchlist pending victim confirmation.
- If you have any EMEA entity in the consortium chain, confirm whether NIS2 Art. 23 is engaged for that entity. The source does not name one, so this is a check, not an assumed obligation.
- Retain the leak-site post and this advisory in the incident file. The post may be removed or altered.
5. Indicators of compromise
No indicators of compromise available in the source material. The source contains no hashes, domains, IP addresses, file paths, registry keys, or email addresses. It contains only the actor's group name, the victim name, the country code, and a prose claim about exfiltrated data.
There are no atomic indicators to place in a copyable block. The only observable is the leak-site listing itself, which is a publication, not a machine-pivotable indicator.
6. Detection
Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values. The only strings present are the actor's group name and the victim name, which are reporting artefacts, not artefacts of the threat, and would detect coverage of this incident rather than the intrusion.
7. Sources
- Ransomware.live, "Victim: World Cup 2034 – Wallstreet", https://www.ransomware.live/id/V29ybGQgQ3VwIDIwMzRAV2FsbHN0cmVldA==, published 2026-10-03. Single source for all victim, data-volume and data-category claims in this advisory.
8. Adverse Trace position
We assess this as a P2 advisory for EMEA financial services clients: the victim is not a financial entity and the source names no exploited vulnerability, so there is no technical action to take, but the leaked data categories (payment certificates, claims, dispute records, bid tabulations, and personal data of 150,000+ employees) are exactly the material that sits in project-finance and trade-finance files, and any client with exposure to this project should treat the document classes as potentially compromised now rather than wait for victim confirmation. The 17 TB figure, the file inventory, and the personal-data claim are single-sourced to the actor's leak-site post and are unverified; the Wallstreet attribution is unconfirmed because the group has no MITRE ATT&CK profile. We will monitor for victim or national-authority confirmation, for any technical detail on the intrusion method, and for further Wallstreet postings that name financial-sector victims, and we will reissue this advisory if the data claims are corroborated or if an initial access vector is published.
Published via PulseTrace — Adverse Trace threat intelligence.