European Ice Hockey Federation

The European Ice Hockey Federation is also referred to as the EIHF. Its headquarters are situated in Belgium. The organization is described in public sources as an international winter sports body. This characterization appears in the context of a cyber‑security incident that involved the federation alongside other similar organizations. No further details about its internal structure, membership, or competitive activities are provided in the available material.

On 1 January 2017 the European Ice Hockey Federation became a target of the threat actor group known as Pawn Storm. The group conducted a series of credential phishing and spear phishing campaigns against the federation. These campaigns employed social engineering techniques such as tabnabbing to trick users into revealing their login credentials. The ultimate aim of the attackers was to gain unauthorized access to the federation’s email systems and potentially exfiltrate further data. To increase the likelihood of success, the phishing messages mimicked legitimate services that the federation was known to use, including Microsoft Exchange and OneDrive. The attackers reused infrastructure and lure templates that had been observed in previous operations against other global sports bodies. The timing of the activity coincided with heightened geopolitical tensions surrounding the participation of Russian athletes in Olympic events.

The incident was documented by Trend Micro in a research article that outlines the group’s updated targets and politically motivated campaigns. By referencing the attack on the European Ice Hockey Federation, the report highlights how sports organizations are increasingly caught in the cross‑fire of geopolitical disputes. The federation’s reliance on widely adopted cloud‑based productivity suites made it a plausible target for credential‑harvesting operations. The observed tactics—reused phishing lures, tabnabbing, and the impersonation of trusted services—are consistent with the broader modus operandi of the Pawn Storm group. Although the available material does not disclose the outcome of the breach, it notes that successful credential theft could enable further data theft from compromised email accounts. Consequently, the episode serves as an illustrative case of how even niche international federations can be drawn into sophisticated cyber‑espionage efforts.