Before the Crowds Arrive: Why Event Security Has to Start Online

Key points

• Criminals preparing to disrupt or defraud major events typically begin registering fake websites and collecting stolen login credentials weeks before the event opens.
• The 2024 Taylor Swift concert plot in Vienna was detected in part through messages on Telegram — a messaging app — before any attack took place.
• Physical dangers and digital dangers are not separate problems: a breach of a hotel booking system can tell criminals exactly where a high-profile attendee is sleeping.
• Security professionals writing in Dark Reading argue that early digital monitoring — watching criminal forums and social media for warning signs — should be built into event planning from day one.
• The killing of UnitedHealthcare CEO Brian Thompson in late 2024 is cited as a reminder that public violence sometimes targets specific individuals, not crowds.

Major public events — a World Cup, a national centennial celebration, a stadium concert — look, from the outside, like logistics problems. Move people in, move people out, keep everyone safe. But according to security and intelligence professionals who work these events, the real risk window opens long before anyone walks through a gate.

Criminals start early. They register website addresses that look like official ticketing pages. They buy or steal login credentials — usernames and passwords — from data breaches and try them against event apps and hotel booking systems. They scrape — automatically copy — publicly available staff directories and vendor lists. They watch social media accounts tied to the event, logging schedules and movements. By the time opening day arrives, the groundwork for fraud, targeting or disruption may already be finished.

How does an online threat become a physical danger?

It crosses over faster than most people expect. A hotel booking system that criminals break into doesn't just expose credit-card numbers; it can reveal exactly which floor a government delegation or a corporate executive is staying on. A fraudulent accommodation listing deceives an attendee online, then leaves them stranded and vulnerable on the ground. Fake ticketing sites harvest payment details digitally, then send buyers to venues they can never enter.

The 2024 Vienna case made this tangible. Authorities disrupted a plot against Taylor Swift concerts after intelligence surfaced from Telegram — a messaging app popular with both ordinary users and criminal networks — before any attack took place. The warning wasn't at the venue. It was online, days earlier.

Security writer Olga Polishchuk, Senior Director of Threat Analysis at intelligence firm ZeroFox, argues that this pattern repeats across every type of large gathering. Premeditated threats leave digital traces first. Small signals — a suspicious post, a newly registered fake domain, a leaked hotel manifest — look isolated on their own. Taken together, they can point toward something serious.

That means event security teams need resources dedicated to watching those online spaces: criminal forums on the dark web (hidden parts of the internet not reachable through normal browsers), fringe social platforms, and mainstream apps alike. Technology can help triage — sort and prioritise — the volume of signals. Human analysts then validate which risks deserve escalation.

Three practical areas matter most. First, high-profile individuals: specific executives, officials or athletes whose public schedules create predictable exposure. Second, everything outside the venue perimeter — hotels, transport routes, fan zones, sponsor dinners — where crowds gather but formal security is thinner. Third, early digital intelligence gathered well ahead of opening day, not the morning of.

If you have tickets to a major event this year, a few things are worth watching. Buy tickets only through official channels; if a deal appears on social media or an unfamiliar website, treat it as suspect. Use a unique password for any event-related account. If your booking confirmation includes hotel details, be cautious about sharing those publicly online.

The security principle here is straightforward: reacting to a threat as it arrives at the front gate is already too late.