A software vulnerability at AllUnited, a Dutch database manager for sports associations, allowed an unidentified attacker to copy the personal records of members.
The breach, which was discovered on November 10, has impacted more than 350 sports clubs that have reported the incident to the Dutch Data Protection Authority.
The attacker gained access to one of the servers through a club website’s registration form on Monday evening. This access enabled the copying of data from the database, including names, addresses, phone numbers, dates of birth, passwords, and bank account numbers.
AllUnited, based in Noordwijk, said that the data of all clubs and associations managed by the system were stolen, though the company has not yet clarified which specific organizations were affected.
The scale of the incident remains difficult to quantify. “De omvang is groot, maar we hebben geen exacte aantallen,” a spokesperson for AllUnited said Wednesday morning.
While the exact number of compromised records is unknown, an Authority for Personal Data spokesperson said Wednesday afternoon that they expect the number of reported clubs to increase.
Various sports organizations and associations have confirmed they were victims, including the Koninklijke Nederlandse Cricketbond (KNCB), the dambond, and the biljartbond. Local clubs such as VV Katwijk, VOC Rotterdam, Nijmegen Atletiek, and the Haagsche Rugby Club also reported being affected. The Atletiekunie and Atletiekvereniging Edam were also identified as having data managed by the system.
The Koninklijke Nederlandse Biljartbond (KNBB) reported that the leak was reported to the Data Protection Authority and that a police report has been filed.
Criminals may use the stolen information for fraudulent activities. Both VV Katwijk and the KNCB have warned members about potential fake messages from criminals. These messages may include requests to pay membership fees or fines via a link in a payment request, which would actually direct funds to the criminals.
AllUnited reportedly discovered the leak on November 10 and closed the vulnerability the same day. The company is resetting all passwords and implementing additional security measures. The KNCB has advised its members to change passwords on other accounts if they use the same password as their AllUnited account.
The identity of the attacker and their specific motives remain unknown, as the company has had no contact with the individual behind the breach. It is currently unclear whether the attack originated from within the Netherlands or from abroad.
