A new study by tech innovation firm GlobalDots has exposed the American sports teams whose names are most frequently compromised in password data leaks, highlighting the risks of using favourite teams as passwords. The research, which analysed password iterations tied to US sports teams, found that passwords linked to the New York Yankees, Dallas Cowboys, and Las Vegas Raiders are the most vulnerable, appearing in hundreds of thousands of data breaches.

The study comes as searches for “any password ideas” have surged by 143% over the past year, according to Keywordtool.io data from 28 March 2025. With many fans turning to their beloved sports teams for password inspiration, the findings underscore the need for stronger cybersecurity practices.

GlobalDots used a pwned password tool to examine password variations associated with 186 American sports teams, ranking them based on their appearance in data leaks. The analysis included 23 password iterations per team, such as “Yankees123” or “cowboys!”, and additional prompts using team nicknames like “Bills” for the Buffalo Bills.

Most hackable sports team passwords

• New York Yankees: Passwords appeared in 198,870 data leaks.
• Dallas Cowboys: Passwords appeared in 185,842 data leaks.
• Las Vegas Raiders: Passwords appeared in 185,665 data leaks.
• Oklahoma City Thunder: Passwords appeared in 174,484 data leaks.
• Orlando Magic: Passwords appeared in 149,483 data leaks.
• Pittsburgh Steelers: Passwords appeared in 146,351 data leaks.
• Texas Rangers: Passwords appeared in 144,714 data leaks.
• New York Rangers: Passwords appeared in 143,923 data leaks.
• Detroit Tigers: Passwords appeared in 124,373 data leaks.
• Philadelphia Eagles: Passwords appeared in 122,989 data leaks.

Other notable teams include the Los Angeles Lakers (118,164 leaks), Los Angeles Dodgers (64,127 leaks), and Minnesota Vikings (68,451 leaks). The full ranking, accurate as of 11 March 2025, is available via GlobalDots’ study.

A GlobalDots spokesperson emphasised the dangers of weak passwords: “If there’s a chance you’ve used any of these teams in your own personal collection of passwords, then this may be the sign you need to look to update your password security. Using weak passwords across multiple platforms could compromise your web security, this includes everything from your private and business cloud data, payment processing accounts, amongst the likes of social media accounts. Using your favourite sports team as a password isn’t as obvious as the likes of ‘1234567’, but it still poses risks with sports being a commonality between many people’s interests.”

The spokesperson offered practical advice for creating secure passwords: “When setting a strong password you should avoid using common words or phrases, including personal information. You should be making sure that your password is at least 12 characters long, is made up of random words or phrases, such as looking around your room and choosing three items that you see first, and should include a mixture of upper and lower case characters, numbers, and symbols. Where possible, passwordless authentication, which uses biometric verification to log into an account, should be used as this can mitigate the risk of password leaks. All of these steps form just one essential part in ensuring your web security solutions are strong enough to manage any potential cyber-attacks.”

The study’s methodology involved collecting data from sources like haveibeenpwned.com, summing the leaks for each team’s password variations, and ranking them from highest to lowest. GlobalDots, a firm with over 20 years of experience in cloud solutions, aims to help businesses navigate cybersecurity challenges through such research.