Cybercriminals are increasingly targeting professional athletes with phishing, impersonation, identity theft, deepfakes, and scams aimed at their families and personal devices. As The Guardian reported, scams against athletes have become a major criminal enterprise, helped by AI tools and the public visibility of sports stars. The business lesson is broader than sport: personal digital risk can become professional, financial, and reputational risk very quickly.
In May 2026, The Guardian reported on the growing industry of scams and cybercrime targeting athletes. The tactics include phishing, celebrity impersonation, identity theft, deepfake content, romance and extortion scams, attacks on family members, and malware delivered through home devices or children’s online activity.
The article describes how cybercriminals exploit the visibility of athletes, using public information from social media, leaked data, sports coverage, travel schedules, endorsements, and family posts to build convincing attacks. One cited case study involved criminals targeting a professional basketball player indirectly through his children’s gaming activity, using malware to gain access to devices on the family home network.
This is not just a sports problem. Athletes are simply a very visible version of a pattern that now applies to executives, board members, founders, public officials, journalists, creators, and high-risk employees. When someone has money, influence, access, or reputation, their personal life becomes part of the attack surface.
The attacker does not need to breach the office if the home network, family inbox, personal phone, or public profile gives them a better route in.
Businesses often treat personal cybersecurity as separate from workplace cybersecurity. That separation is getting harder to defend.
Employees use personal phones for work messages. Executives travel with devices. Family members share Wi-Fi networks. Public social media gives attackers context for impersonation. Personal email accounts can become routes into password resets. Children, spouses, assistants, managers, and agents may all become indirect targets. AI makes it easier to turn scattered public details into convincing messages, fake voices, realistic images, and tailored scams.
For high-profile individuals, this risk is obvious. For ordinary employees, it is still real. A compromised personal account can expose work contacts. A malware-infected home device can capture credentials. A deepfake voice message can pressure someone into approving a payment. A personal breach can become a business incident when identities, devices, or trust relationships overlap.
That is why this story belongs in a human risk management series. It shows that the “human endpoint” is not limited to a company laptop. People bring their habits, homes, devices, families, stress, and online lives into the security picture.
A cybercriminal does not care where the org chart says the perimeter ends.
Athletes are attractive targets because their lives are visible, valuable, and emotionally connected. Attackers can learn where they travel, who they know, what they endorse, who represents them, which charities they support, and how their families appear online. That public context helps criminals build trust.
The same dynamic applies in business. Executives post about conferences. Sales teams share customer wins. Employees list job roles and tools on LinkedIn. Teams celebrate new partnerships. Leaders appear on podcasts. None of that is wrong. Visibility builds brands, careers, and relationships.
The risk appears when attackers use that visibility to create believable pressure. A fake message from a known contact. A voice clone of a family member. A phishing email timed around travel. A fraudulent invoice referencing a real vendor. A scam that uses a child, spouse, assistant, or colleague to make the request feel urgent.
Human risk management has to prepare people for that kind of manipulation. The answer is not “go live in a cave and delete LinkedIn.” Tempting some days, but commercially inconvenient. The better answer is to build habits around verification, privacy, device hygiene, and escalation.
Organizations should identify employees whose personal exposure could create business risk. That includes executives, finance leaders, HR teams, legal teams, IT administrators, security staff, public-facing spokespeople, and anyone with access to sensitive systems, money movement, or confidential information.
Those groups need more than generic awareness training. They need practical guidance on social media privacy, home network security, personal email protection, family-device risks, travel security, voice-clone scams, impersonation, and what to do when a personal account is compromised.
Companies should also normalize verification. If a senior leader appears to request money, access, data, secrecy, or urgency through an unusual channel, employees should feel empowered to confirm through a trusted second route. That habit protects the executive as much as the employee receiving the request.
For high-risk roles, consider executive cyber protection support, personal-device guidance, family-awareness resources, and incident playbooks that include personal-account compromise. The goal is not to invade private lives. The goal is to recognize that attackers already have.
The athlete scam story is a human risk management story because it shows how personal digital behavior, public information, family exposure, and professional risk now overlap.
Cyber culture has to help people understand that attackers target the whole human, not just the work inbox. That means training people to think about trust, context, pressure, and verification across work and life. It also means supporting employees without blaming them for being visible, successful, social, busy, or human.
For Cybermaniacs, this is where modern human risk management becomes more personal, practical, and compassionate. People need skills they can use at work and at home: safer passwords, MFA, device hygiene, privacy settings, scam recognition, reporting habits, and confidence to pause before acting.
Athletes may be the headline, but the lesson applies to anyone whose identity, access, or influence has value. In other words, most organizations have more at-risk humans than they think.
Athletes are visible, wealthy, influential, and surrounded by valuable relationships. Attackers can use public information, social media, leaked data, and family connections to create convincing scams.
Reported tactics include phishing, identity theft, impersonation, deepfakes, romance and extortion scams, malware, attacks on family devices, and scams involving agents, managers, or trusted contacts.
The same tactics can target executives, finance teams, public spokespeople, administrators, and employees with privileged access. Personal compromise can become business compromise when identities, devices, accounts, or trust relationships overlap.
Provide role-specific training for high-risk employees, encourage MFA and password managers, support personal-device hygiene, teach verification habits, review public exposure, and prepare response plans for personal-account compromise.
Because attackers target human trust, visibility, relationships, stress, and routine behavior. Human risk management helps people build safer habits across work and life without turning security into fear or blame.