Ajax Amsterdam Suffers Data Breach After Hacker Exploits IT Vulnerabilities Dutch football giant AFC Ajax confirmed a security breach after a hacker exploited vulnerabilities in its IT systems, gaining unauthorized access to sensitive data. The incident, first reported by journalists tipped off by the attacker, exposed email addresses of a few hundred individuals and personal details including names, email addresses, and birthdates of fewer than 20 people with stadium bans. Investigative journalists from RTL independently verified the flaws, demonstrating how the hacker could reassign season tickets, modify stadium ban records, and access fan data through unsecured APIs and shared keys. In a test, they transferred a VIP season ticket in seconds and confirmed potential access to 42,000 season tickets, 538 supporter bans, and over 300,000 fan accounts. Ajax stated that the exposed data was viewed but not leaked, and all identified vulnerabilities have since been patched. External cybersecurity experts are assessing the incident’s full scope, while Dutch authorities, including the Data Protection Authority and police, have been notified. The hacker’s decision to disclose the flaws via media rather than exploit them for profit suggests limited malicious intent. However, it remains unclear whether the vulnerabilities were previously discovered or abused. The club has implemented additional security measures to prevent future breaches.