AFC Ajax Hack Exposed Fan Data and Enabled Ticket Hijacking
Summary
AFC Ajax said a hacker accessed email addresses belonging to a few hundred people and personal details for fewer than 20 people with stadium bans. RTL verified flaws that also enabled ticket transfers and changes to records; Ajax says it patched them.
Key points
- AFC Ajax said a hacker unlawfully accessed parts of its systems and viewed email addresses belonging to a few hundred people.
- The club said names, email addresses, and birth dates for fewer than 20 people with stadium bans were accessed.
- RTL journalists verified vulnerabilities that let them transfer season tickets, modify stadium-ban records, and access fan data through APIs and shared keys.
- RTL said the flaws could expose details on more than 300,000 accounts and allow manipulation of 42,000 season tickets and 538 stadium bans; these were demonstrated capabilities, not reported confirmed changes to all those records.
- Ajax said the exposed data had not been leaked, patched the identified vulnerabilities, introduced additional security measures, and notified Dutch authorities and police.
- The club engaged external experts to investigate the incident's scope and root cause; it remains unclear whether the weaknesses had been discovered or exploited before.
Article Details
- Victim Organization
- AFC Ajax
- Incident Type
- Unauthorized access to club IT systems through exploited vulnerabilities; exposed APIs and shared keys also enabled ticket transfers and stadium-ban record modification.
- Data Types Exposed
- Email addresses
- Names
- Dates of birth
- Affected Records
- AFC Ajax said email addresses for a few hundred people were viewed and names, email addresses, and dates of birth for fewer than 20 people with stadium bans were accessed. RTL journalists demonstrated potential access to details on over 300,000 accounts; this was not reported as confirmed access by the hacker.
- Operational Impact
- RTL journalists demonstrated that season tickets could be transferred and stadium-ban records modified. RTL said the vulnerabilities could allow manipulation of 42,000 season tickets and 538 stadium bans. AFC Ajax reported patching the vulnerabilities and adding security measures; no actual ticket manipulation or operational disruption by the hacker was reported.
- Ransom Or Extortion
- None reported. The article says the attacker disclosed the flaws via the media rather than exploiting them for profit or extortion, while noting the extent of any prior exploitation is unclear.
- Claim Status
- confirmed