Loading story…
AFC Ajax disclosed a breach after an unknown hacker exploited vulnerabilities in the club’s app and website, including exposed APIs and shared access keys, to access parts of its IT systems. Ajax said the incident exposed email addresses belonging to a few hundred people, while records for fewer than 20 individuals subject to stadium bans included names, email addresses, and dates of birth. The club said it patched the flaws, engaged external experts to investigate, filed a police report, and notified the Dutch Data Protection Authority.
Reporting on the incident indicated the weaknesses could have allowed access to private data tied to more than 300,000 registered Ajax fans, as well as tampering with stadium-ban records and the theft or disabling of more than 42,000 season tickets. Ajax said the breach was brought to its attention by an RTL journalist who had been contacted by the hacker, and added that it had no indication the data had been further distributed, while warning supporters to watch for spam and phishing emails.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
The Dutch National Police arrested a 35-year-old man from the municipality of Buren on suspicion of hacking AFC Ajax multiple times earlier in 2026. The arrest took place on May 26 as part of the investigation into the previously disclosed breach.
Ajax disclosed that email addresses of a few hundred people were exposed and that, for fewer than 20 individuals subject to stadium bans, names, email addresses, and dates of birth were accessed. The club said it had no indication the data had been further disseminated.
Ajax said it fixed the vulnerabilities, strengthened security measures, began an investigation with external experts, filed a police report, and notified the Dutch Data Protection Authority. The club also warned users to stay alert for spam and phishing following the breach.
The breach came to Ajax's attention after an RTL journalist was contacted by the hacker and informed the club. This disclosure prompted Ajax to investigate the reported vulnerabilities and unauthorized access.
An unknown attacker gained access to parts of AFC Ajax's IT systems by exploiting vulnerabilities in the club's app and website, including exposed APIs and shared access keys. The flaws reportedly could expose private data of more than 300,000 registered fans and enable tampering with stadium bans and season tickets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcepolitie.nl
Open sourcehelpnetsecurity.com
Open sourcecybernews.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor allegedly leaked data from the Asian Football Confederation (**AFC**) and records tied to **Al Nassr FC**, claiming exposure of more than **150,000** player, coach, and member records on a cybercrime forum and the dark web. Reported samples included passport scans and numbers, contracts, verified email addresses, AFC registration files, AFC IDs, and detailed player information such as names, dates of birth, nationalities, club affiliations, match details, and venue data. The seller called it the "largest breach in football history" and invoked **ShinyHunters**, but Dataminr assessed that reference as likely an attempt to borrow the group’s reputation rather than evidence of direct affiliation. Researchers warned that the combination of identity documents, contract data, and verified contact information could enable **identity fraud**, **business email compromise**, contract manipulation, and highly targeted social engineering against athletes, coaches, and officials. Dataminr also noted that some allegedly leaked documents included diplomatic passports, expanding the potential impact beyond sports operations to tournament logistics and broader national security concerns as AFC member nations prepare for the 2026 FIFA World Cup. At the time of reporting, the AFC had not publicly commented on the alleged compromise, while security experts urged organizations to review athlete-data storage, third-party access, financial verification workflows, and monitoring for suspicious communications.
Jun 29, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
The Argentine Football Association (**AFA**) is investigating a suspected compromise after attackers allegedly used credentials stolen from a software developer’s device infected with an infostealer in September 2025. The intrusion surfaced when mass emails were sent from legitimate AFA domains falsely claiming Argentina had “stolen” a World Cup win from Egypt, indicating unauthorized access to internal systems. Security researchers at Hudson Rock said the stolen credentials may have enabled broad administrative access across AFA assets, including databases, management portals, media infrastructure, and the competition system. Data later advertised on cybercrime forums was said to include staff, club, and partner information, along with internal email addresses, phone numbers, user roles, registration timestamps, subdomain access listings, and some plaintext passwords. Hudson Rock also reported that weak password reuse across internal systems likely worsened the breach’s impact by allowing wider lateral access once the initial credentials were obtained. AFA acknowledged possible unauthorized access and said it is investigating the incident and implementing security measures.
Jul 14, 2026