Ajax Confirms Data Breach Exposing Fan Data and Season Tickets Dutch football club Ajax has acknowledged a data breach affecting its website, following reports by RTL Nieuws. The incident exposed email addresses of several hundred individuals, while a smaller group fewer than 20 supporters with stadium bans had their names, email addresses, and birth dates accessed. According to Ajax, the breach may have allowed attackers to reassign season tickets and modify stadium bans. The club has notified affected individuals and reported the incident to the Dutch Data Protection Authority, as well as filing a police report. Authorities have not yet disclosed details, but an investigative team is actively examining the case. RTL Nieuws’s findings suggest the breach could have impacted over 300,000 registered Ajax fans, with potential exposure of personal data. Additionally, more than 42,000 season tickets may have been stolen or disabled, while the records of 538 banned supporters could have been altered or lifted. The vulnerability stemmed from an insecure API on Ajax’s website, allowing attackers to extract data without authentication. Amsterdam’s Police Cybercrime Team is investigating possible links to the recent takedown of the criminal forum LeakBase, where Dutch company databases were previously sold. Ajax has since patched the flaw and strengthened security measures. The club previously faced a 2021 data breach on a fan platform, prompting earlier cybersecurity improvements.

Ajax Soccer Club Hit by Data Breach Affecting 300,000+ Supporters Dutch professional soccer club Ajax has confirmed a data breach after detecting unauthorized access to parts of its IT systems. The incident exposed personal information belonging to over 300,000 supporters, prompting the club to initiate a security overhaul. The breach was discovered following suspicious activity within Ajax’s digital infrastructure. While the exact timeline of the attack remains unclear, the club has acknowledged the compromise and is working to assess the full scope of the exposure. Details on the type of data accessed such as names, contact information, or payment details have not been fully disclosed. Ajax has not attributed the breach to a specific threat actor or method, though the incident underscores growing cybersecurity risks for sports organizations handling large volumes of fan data. The club’s response includes enhanced monitoring and system protections to prevent future intrusions. The breach follows a rising trend of cyberattacks targeting high-profile entities, with sports clubs increasingly viewed as lucrative targets due to their extensive user databases and public visibility. No further details on regulatory notifications or potential legal consequences have been released.