Back Universiteitleiden.Nl

Hack at Ajax: leaked season tickets and stadium bans

Universiteitleiden.Nl • March 26, 2026

A hack at Ajax let season tickets be stolen and stadium bans viewed and changed. Bart Schermer, Professor of Privacy & Cybercrime, spoke to RTL News the impact. ‘This information can be used against you.’

The hack at the Amsterdam football club Ajax made it possible to view the personal data of more than 300,000 registered supporters. More than 42,000 season tickets could be transferred or invalidated. Season ticket holders could do little to stop it – their ticket suddenly disappeared from their account and could no longer be used afterwards.

Not only that, the hack made it possible to see which 538 Ajax supporters have a stadium ban. Because of the failings in digital security, those exploiting the breach could even modify personal data and remove stadium bans.

'This information can be used against you,' Bart Schermer says. 'Potential employers are unlikely to hire someone with a stadium ban, especially for certain jobs. Indirectly, it tells them something that person.' The professor warns that this sensitive personal information can be used for blackmail or extortion.

Read the full RTL Nieuws article (in Dutch) Read the full NOS article (in Dutch)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AFC Ajax Data Breach Exposes Fan Data and Ticketing Vulnerabilities AFC Ajax, the Dutch football club, reported a data breach where a hacker exploited vulnerabilities in its IT systems, accessing email addresses of a few hundred supporters and personal data of fewer than 20 individuals with stadium bans. The attack leveraged exposed APIs and shared access keys, allowing unauthorized ticket transfers and modifications to stadium bans. RTL News demonstrated the ease of exploiting these vulnerabilities, including transferring a VIP ticket from a club director's account. The breach potentially affected over 300,000 registered supporters and exposed details of 42,000 season tickets. Ajax has patched the vulnerabilities and notified the Dutch Data Protection Authority and police. The club stated that the exposed data has not been leaked, but fans are advised to remain vigilant against suspicious communications. The incident raises concerns about the security of personal data and the potential for misuse. 5 sources 65

Extracted Entities

Hack at Ajax: leaked season tickets and stadium bans

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)