Soccer club Ajax suffers data breach exposing fan information, prompts security overhaul

Ajax, a leading professional soccer club in the Netherlands, has disclosed a data breach affecting more than 300,000 supporters after unauthorized access to parts of its IT systems was discovered.

The club confirmed that a hacker gained entry into its digital infrastructure, prompting an internal investigation supported by external cybersecurity specialists. The breach has been reported to the Dutch Data Protection Authority, and a police report has been filed.

Ajax said the scope of confirmed data exposure remains limited. Email addresses of several hundred individuals were viewed, while more sensitive personal information was accessed in fewer than 20 cases involving individuals with stadium bans.

The organization stated that vulnerabilities responsible for the breach have been identified and resolved. Additional safeguards have been implemented to strengthen system security and prevent similar incidents.

Affected supporters have been notified and advised to remain cautious when receiving unsolicited emails or messages, particularly those containing links or attachments from unknown sources.

Ajax indicated there is currently no evidence that the accessed data has been widely distributed. However, the club emphasized the importance of vigilance against phishing attempts and other forms of digital fraud.

Independent findings revealed broader potential risks tied to the breach. System weaknesses allowed unauthorized access to personal data of a large number of fans and exposed functionality that could enable actions such as transferring match tickets or modifying stadium bans. The issue stemmed from shared digital access mechanisms and vulnerabilities within the club’s application interfaces and website.

Ajax leadership acknowledged concerns among supporters regarding data security and stated that while absolute protection cannot be guaranteed, efforts are ongoing to minimize risks and strengthen defenses.