Cybersecurity in Events: What to Know in 2026 and Past – Stova

From knowledge leaks and faux occasions to expensive instances of fraud, threats over the web have been a hazard to occasions since its inception. However, opposite to the guarantees of AI builders, new developments from AI to quantum computing have largely undermined the standard cybersecurity playbook and, in some instances, introduced all new dangers.

What are the dangers to an occasion, and what does an occasion staff want in place to safeguard attendees, knowledge and occasions from dangerous actors?

The Risks

Deepfakes, Fake Events and Fraud

While many people consider cybersecurity threats as being extremely technical, the commonest scams contain exploiting human errors to achieve in any other case prohibited entry to methods, knowledge or funds.

Imposter scams contain a nasty actor who solicits funds underneath false pretenses by pretending to be a authentic recipient. After funding scams, imposter scams have been the most expensive kind of fraud with nearly $3 billion reported misplaced in 2024. Losses from scams particularly involving enterprise and job alternatives totaled $750.6 million USD in 2024, which is a $250 million improve in comparison with 2023.

Case in level. This is what occurred to Liz Lathan, who paid $40,000 USD to an imposter by way of an misguided e-mail designed to look precisely like her venue’s. Fortunately, whereas Lathan was unable to get better the cash, she and her staff have been in the end in a position to pay the venue and transfer ahead with their occasion.

Case in level. Fraudsters may also impersonate purchasers. When “Gregory Mount” of Glidden Paints reached out to Nirjary Desai with a launch get together and a listing of most popular distributors, she requested invoices, tax paperwork and cellphone conversations to validate them. Once offered, she was instructed to pay the distributors up entrance and that she could be reimbursed. While it initially appeared as if she had been, the cost was made utilizing a stolen bank card and was later invalidated. 

To make issues worse, Desai offered her banking info to enroll in Glidden’s central cost system, which the rip-off artists used to forge an bill and withdraw an extra $10,000 from her account, leaving her out nearly $20,000 in complete.

Per Skift’s reporting, “79% of organizations experienced attempted or actual payments fraud” in 2024 and “the most common method is business email compromise — often through spoofed emails and fake vendor scams like this one.”

According to IBM cybersecurity knowledgeable Jeff Crume, synthetic intelligence (AI) is barely making scams like these simpler to execute. Using generative AI, rip-off artists can now fabricate extra convincing and personalised phishing emails, and consistently bettering deepfakes are already getting used to rip-off organizations out of hundreds of thousands of {dollars}. Per Crume’s video, an attacker utilizing a deepfake was in a position to emulate the CFO of a significant retailer and persuade an worker to wire $25 million to the scammer’s account. More just lately, a deepfake was famously used to undermine the democratic get together within the New Hampshire major by fabricating a robocall of Joe Biden telling folks to not hassle voting.

Data Leaks and Breaches

Event trade knowledge leaks happen when attendee, workers or operational knowledge is nefariously accessed and uncovered – typically with dire penalties together with reputational injury, monetary penalties, non-compliance with knowledge safety legal guidelines such because the GDPR and different authorized liabilities.

Within the occasion trade, assaults like these have impacted nearly each hyperlink within the provide chain from world famend venues to third-party ticketing platforms and even ubiquitous skilled system suppliers like Microsoft. 

Case in level. Stadium administration firm Legends International, LLC suffered a knowledge breach on November 9, 2024 that compromised the information of each venue workers and guests. According to a report submitted to the Texas Attorney General’s Office in April of this yr (2025), the leak doubtlessly uncovered Social Security numbers, monetary account info, government-issued ID numbers and medical info. Despite instantly taking measures to mitigate the damages, conducting an investigation and notifying these whose knowledge might need been leaked, Legends was taking a look at a possible class motion lawsuit. Though it seems the first plaintiffs representing Legends’ workers in the end dropped the costs, the case exhibits that the victims of those crimes could themselves be liable if their danger administration is seen as missing.

However, the brink for due diligence could also be transferring as AI opens new avenues for individuals who wish to hack right into a enterprise’s methods. Crume warns that AI can already be used to jot down malware that may break into current methods and instruments, which implies that dangerous actors don’t even must be tech specialists. A latest examine supported by IBM discovered that, inside a managed atmosphere, GPT-4 was in a position to autonomously exploit real-world methods 87% of the time when given an ample description of a zero-day vulnerability (i.e. a bug or flaw within the code that the seller was unaware of). This has already occurred in the actual world, based on Crume, who cites a significant on-line retailer that attributes a reported 7x improve within the variety of cyber assaults to AI.

Quantum Computing

As with cases of fraud, exploiting human errors is presently one of the crucial frequent strategies of having access to delicate knowledge. There is an adage in cybersecurity circles: Hackers don’t hack in, they log in.

This is as a result of passwords are closely encrypted throughout storage and transmission, and cracking that encryption by brute drive (e.g. by making an attempt each doable character mixture or answer till they get the fitting one) may take typical computer systems literal centuries – even utilizing AI.

However, Crume notes that quantum computing has the potential to render present encryption requirements out of date within the subsequent 5 to 10 years. According to Specops, it’s because conventional cryptographic methods financial institution on the processing pace of typical computer systems, which is restricted by the binary manner (1s and 0s) they symbolize knowledge. Quantum computer systems, however, use a capability referred to as “superposition” to symbolize knowledge in a number of states on the identical time. What may take a traditional pc 1000s of years to course of may solely take a quantum pc minutes.

So if the expertise isn’t there but, why is that this a danger for 2026?

Because knowledge breaches are nonetheless taking place and dangerous actors can “harvest now, decrypt later,” as Crume places it. Protecting knowledge is extra vital than ever as a result of the complete impression of breaches taking place now could solely turn into evident years down the road, when hackers have entry to way more refined strategies of breaking present encryptions.

To put together for that, Crume recommends utilizing multifactor authentication together with safer passkeys, that are primarily based on a “challenge-response” system by which customers are requested to do one thing within the second that offers them entry, like scan their face or fingerprints – though Specops signifies that these may also ultimately need to be bolstered when quantum computing turns into extra obtainable.

Unverified AI Implementations and Increased Attack Surface

Artificial intelligence doesn’t solely current a danger within the arms of dangerous actors, it will increase the chance once we use it as nicely. The variety of potential entry factors (a.okay.a. the “attack surface”) will increase each time a brand new piece of tech is added – and that now consists of AI. For Crume, this manifests in two methods.

The first is what he calls “shadow AI” whereby AI is getting used on the down low for functions past what has been permitted or vetted inside a corporation. As many rush to unexpectedly implement AI instruments and providers with no actual safety vetting course of, the speedy adoption is solely outpacing the flexibility to responsibly perceive and handle danger. As folks in any respect strata of a corporation subscribe to the “move fast and break things” mantra, it can turn into more and more troublesome for corporations to regulate which AI functions are getting used. 

On the opposite, there’s mounting stress inside the broader job marketplace for inexperienced customers to “vibe code” AI automations and brokers themselves with no actual understanding of the vulnerabilities they may be introducing. This danger is compounded by the location of AI in all cell units (which have been already susceptible to successfully changing into hackable surveillance methods).

The second is thru “prompt injection,” which is a course of of coaching or socially engineering AI to misbehave. Bad actors are consistently testing limits to be able to break the guardrails, and based on the Open Worldwide Application Security Project (OWASP), it’s the primary assault on LLMs that energy the most well-liked generative AI providers, instruments and plug-ins professionals are utilizing.

The Measures

Training and Vigilance

Human vulnerability stays the very first thing dangerous actors will attempt to exploit, so coaching workers to acknowledge and cope with scams ought to be a corporation’s first line of defence. Speaking with TSNN, Maritz VP of Product Management Aaron Dorsey careworn the significance of “making security a part of your [business] culture” with cyber safety coaching in any respect ranges. This additionally applies to AI, famous Maritz CTO John Wahle, who believes that embracing AI from the highest down supplies the steering essential to implement it safely.

In phrases of the place to supply that coaching, there are lots of programs for small companies and professionals on platforms like Coursera and Udemy – typically created in partnership with well-established organizations like IBM and Google. The CISA Learning platform additionally provides a variety of programs on cybersecurity and in numerous codecs, a lot of that are on demand.

Once workers is conscious of the hazards, somewhat vigilance can go a good distance in figuring out frequent scams (phishing over e-mail and textual content messages, malware, and dangerous end-user habits). While incorrect spelling and grammar could not give away a phishing scheme, there are some things that ought to be flagged. These embody e-mail addresses that look incorrect or don’t match an organization’s internet area, a generic greeting that refers back to the recipient as “user” or “customer,” calls to motion to log into or obtain one thing and a way of urgency.

However, as deepfakes enhance, extra steps could also be warranted in verifying a contact’s id – particularly the place giant sums are concerned. “From now on, large payments always come with a phone call,” mentioned Lathan, who has made it a coverage that anybody processing funds at Club Ichi full fraud consciousness coaching. However, AI has already been used to swindle folks by deepfaked voices, so we may have to plan new methods of validating that we’re chatting with the fitting particular person. One technique may be to insist on trying up the group’s cellphone quantity on the official web site, calling them straight and asking to be transferred to the particular person in query.

Live Events

Of course, relating to the chance of imposters, dwell occasions stay a bastion of belief as vendor relationships are constructed nose to nose and offers may be struck in particular person. As more and more competent deepfakes place extra of a burden on authentic companions, we will anticipate extra enterprise to begin on the commerce present ground.

However, to make sure occasion knowledge stays safe, it’s vital to make use of a good occasion tech platform. Stova’s whole ecosystem, from the purpose of registration to the post-event analytics, is compliant with essentially the most rigorous knowledge safety requirements. Our lead seize expertise supplies exhibitors and attendees a safe, seamless solution to change contact info, and our cell occasion app and digital occasion platform provide a safe closed-access venue for ongoing conversations.

Cyber Security Certifications and Data Management Best Practices

According to Skift Meetings’ Event Tech Almanac 2025, whereas all occasion administration platforms they reviewed complied with GDPR, consumer roles and permissions and ISO27001 certification, 1 / 4 failed to supply knowledge encryption and SOC2 compliance. 

Stova is dedicated to sustaining the very best requirements of safety, which is vital as these requirements evolve. The National Institute of Standards and Technology (NIST) is already working to develop requirements for post-quantum cryptographic algorithms, they usually provide suggestions and schooling for organizations getting ready for post-quantum cybersecurity. 

Another solution to defend attendees and different stakeholders from knowledge breaches is solely keep away from housing knowledge unnecessarily. Writing for Conference News, Adrian Pragnell recommends accumulating “only the data that is necessary for the event’s purpose(s)” and robotically deleting any knowledge you not want. Not solely would this scale back the fallout of any potential breach, it additionally helps compliance with GDPR and rising US state legal guidelines that restrict the use and retention of information. 

However, your potential to do that is essentially dependent in your occasion tech stack – one more reason to be cautious when deciding on occasion tech companions. Per Skift Meetings’ Event Tech Almanac 2025, “[while] most event tech vendors act as data processors, giving clients full ownership and control of attendee data… some vendors use a shared data ownership model, requiring attendees to become platform users.” The query of whether or not tech platforms ought to be capable of retain an occasion’s attendee knowledge as soon as the occasion has ended has fuelled a years-long debate within the trade. 

Stova’s place is that occasion organizers ought to retain full management over their occasion knowledge, which can solely stay on the platform so long as it serves them.

Pragnell additionally recommends that insurance policies be bolstered with complete audits and an incident response plan to mitigate damages and losses for affected people. For instance, Legends International provided all these affected by its breach two years of complimentary id safety by way of Experian IdentityWorks. Conducting “tabletop exercises” that simulate breaches may also assist to make sure everybody is ready within the occasion of an assault.

Conclusion

Cybersecurity in occasions is not nearly firewalls and anti-virus software program – it’s about anticipating dangers which are evolving alongside the applied sciences we use day by day. From AI-powered phishing emails to the looming potential of quantum computing, the stakes are excessive and on the rise for organizers who deal with delicate private and organizational knowledge.

What this implies in observe is twofold. First, vigilance and coaching are non-negotiable. Human error stays the commonest level of entry, and even essentially the most refined methods may be undone by a little bit of misplaced belief. Building a tradition of safety consciousness at each stage of your group is the strongest protection towards scams and breaches.

Second, your selection of expertise companions issues greater than ever. Platforms that prioritize compliance, transparency, and knowledge possession not solely scale back your publicity to cyber threats but additionally provide you with peace of thoughts that attendee belief is being safeguarded. Stova, for instance, is dedicated to making sure organizers retain full management over their knowledge whereas assembly the trade’s most rigorous safety requirements.

The message for 2026 is evident: cybersecurity is just not a one-time funding, however an ongoing self-discipline. By combining robust companions, safe methods and well-trained groups, occasion professionals can carry on high of the altering tendencies and preserve the belief of attendees and different stakeholders utilizing their expertise.