Ajax Amsterdam has confirmed a significant data breach resulting from a system vulnerability that allowed unauthorized access to sensitive information. While the club initially reported limited exposure, subsequent reports indicate that the personal data of approximately 300,000 fans may have been compromised.
Ajax recently discovered that a hacker gained unlawful access to its internal systems through a security flaw that has since been repaired. In an official statement, the club acknowledged that the intruder viewed various datasets and accessed the email accounts of several hundred individuals. They also noted that specific personal details, including names and birth dates, were exposed for a small group of people currently under stadium bans.
Despite the club's suggestion that the impact was restricted to a few hundred accounts, investigative reports tell a more concerning story. Local news outlets and cybersecurity researchers have indicated that the breach was far more extensive than originally disclosed. These reports suggest that the personally identifiable information of roughly 300,000 supporters was actually left vulnerable to the attacker.
The discrepancy in these figures stems from how the vulnerability was identified and reported. An ethical hacker originally demonstrated the security weakness to journalists, showing that a massive database of fan information was accessible. This contradicts the club's initial framing of the incident, which implied that only a minimal amount of data, much of it already public, had been viewed by the intruder.
In response to the incident, Ajax has taken several steps to mitigate the damage and prevent future occurrences. The club notified all affected individuals and issued warnings regarding the heightened risk of phishing attacks. Furthermore, they reported the situation to the Dutch Data Protection Authority and law enforcement agencies to ensure a proper legal and regulatory investigation into the matter.
The situation highlights the ongoing digital risks faced by major sports organizations that manage large volumes of fan data. While the club has patched the specific vulnerabilities that allowed the access, the exposure of 300,000 records serves as a reminder of the scale of potential damage in modern cyberattacks. The incident remains under scrutiny as authorities evaluate the club's data protection practices.
Source: https://english.ajax.nl/articles/information-about-data-breach-at-ajax/