Eden Park DNS error exposed email infrastructure via expired domain

New Zealand’s national stadium, Eden Park, experienced a cybersecurity vulnerability due to an expired domain in its DNS configuration. The stadium’s email settings referenced an expired anti-spam domain, spamcontrol.co.nz, which allowed email deliverability consultant Alex Shakhov to capture DMARC reports for approximately one year.

Shakhov reported that by registering the lapsed domain, he was able to map Eden Park’s email infrastructure within 30 days. The reports provided visibility into approximately 600 entities the stadium communicates with, including sponsors, sports associations, event companies, and celebrity agents. Shakhov noted that this information could serve as a foundation for targeted phishing campaigns against brands associated with the stadium.

Eden Park stated that no data was compromised and has since updated its DNS settings. Fujitsu confirmed that the domain in question belonged to a defunct anti-spam service that was retired in June 2021. Shakhov claimed he attempted to contact the stadium’s security and IT leadership regarding the issue for 12 months prior to the public disclosure.