1,393 sports-sector matches are exposure, not evidence of compromise

A sector count invites a conclusion it cannot support. The 1,393 matches returned for the sports label on 7 October 2026 describe what is reachable, and the distance between reachable and compromised is where most analytical errors happen.

What the count is

A Search query against the ZoomEye international index, with sub_type set to all and a page size of one:

industry="sports" -> 1,393

The total is the number of indexed assets the classification places in the sector. Every one of them responded to the crawler.

What the count is not

It is not a count of victims. An exposed service is a fact about configuration; a compromise is a fact about an incident, and it is established by forensic evidence rather than by a port being open. The same gap applies to every derived query. Zero matches for remote-desktop and SSH services inside the label means those services were not seen in the sector subset, not that they are absent.

The evidence that would change the statement

Exploitation claims rest on incident reports, on confirmed indicators, or on catalogue entries such as the CISA Known Exploited Vulnerabilities list, which records exploitation rather than exposure. None of those sources is a ZoomEye count, and none should be quoted as one.

Why the distinction matters

Overstating a count turns a scoping tool into a scare headline, and it makes the following question unanswerable: which of these 1,393 assets actually needs attention first? The useful output is a shortlist an owner can confirm, not a sector verdict.

References

• ZoomEye international search index: https://www.zoomeye.ai/
• CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NCSC, The cyber threat to sports organisations: https://www.ncsc.gov.uk/report/the-cyber-threat-to-sports-organisations