Dutch police have arrested a 35-year-old man in connection with a significant data breach at the Ajax football club. The suspect is accused of repeatedly gaining unauthorized access to the club's IT systems, potentially compromising the personal information of hundreds of thousands of supporters.
The incident initially came to light earlier this year, with the club downplaying the scope of the breach and suggesting only a few hundred fans were affected. However, subsequent reports indicated that the personal details of approximately 300,000 registered Ajax supporters may have been exposed, a figure vastly larger than the club's initial assessment.
The vulnerability was reportedly linked to the official Ajax mobile application, which fans use for accessing tickets. This weakness allegedly allowed an attacker to view supporters' personal details, steal and resell match and season tickets, and even access or modify information concerning individuals banned from attending matches.
The ability for unauthorized parties to manipulate the ban list raised particular concerns. It was discovered that an attacker could potentially remove individuals from the ban list, including those banned for hooliganism, or conversely, add innocent individuals to the list. This capability could have serious repercussions, as being banned from football matches might negatively impact an individual's prospects, for example, with potential employers.
Ajax has stated that it has collaborated with external cybersecurity experts to address the identified vulnerabilities and has implemented security enhancements. While these measures are intended to prevent future incidents, they offer little recourse for individuals whose data may have already been compromised.
The exposure of a database containing email addresses of football fans presents a potential target for scammers. Such information could be exploited to launch phishing attacks, with attackers impersonating the club to offer fake ticket deals, refunds, or special promotions to unsuspecting supporters.
