Hundreds of Dutch sports clubs report cyberattack exposing members' personal data
More than 350 Dutch sports clubs have reported a data breach to the Dutch Data Protection Authority (AP) following a cyberattack on membership administration system AllUnited on Monday evening. The number of reports is expected to rise further, an AP spokesperson said on Wednesday. The breach may have exposed members' personal information, including home addresses, passwords, and bank account numbers.
AllUnited, which is based in Noordwijk, provides an online administration system used by sports clubs and federations to manage memberships, subscriptions, payments, bookkeeping, registration forms, and invoicing.
The company says 35 sports federations are connected to its software, including the Royal Dutch Football Association (KNVB), the Royal Dutch Hockey Association (KNHB), the Royal Dutch Tennis Association (KNLTB), the national basketball association (NBB), and the Dutch swimming association (KNZB).
However, not every organization listed as a partner uses AllUnited for its own membership administration. "The Atletiekunie’s membership administration is handled via Volta, a system separate from AllUnited that was not affected by the data breach,” the Atletiekunie, the national athletics federation, said.
AllUnited confirmed on Wednesday morning that an unknown outsider had copied information from its database. The company said the breach affected data belonging to all sports federations and clubs using its services, although it could not yet establish exactly how many individual records had been compromised. "The scale is large, but we do not have exact numbers," a spokesperson said.
The attacker exploited a vulnerability in a registration form on a sports club's website to gain access to one of AllUnited's servers. They were then able to copy information from the database. The Royal Dutch Cricket Association (KNCB) said the vulnerability was discovered and fixed on Tuesday.
The stolen information may include members' names, home addresses, email addresses, telephone numbers, dates and places of birth, and bank account numbers (IBANs). Login credentials and passwords associated with AllUnited accounts may also have been compromised. The company said it had no contact with the attacker, leaving it unclear whether the attack originated in the Netherlands or abroad and what the perpetrator's intentions were.
More than 350 sports clubs have already reported the incident to the AP, which expects that figure to increase. Several sports federations, including the national cricket, draughts, and billiards associations, have also confirmed that they were affected. The KNCB and various local clubs have warned members about the breach and the potential misuse of their information.
Among the local clubs confirming they were affected are football club VV Katwijk, VOC Rotterdam, Nijmegen Atletiek, and Haagsche Rugby Club. Several organizations have advised members to remain particularly alert to suspicious emails, text messages, phone calls, and payment requests, as criminals could use the stolen information in phishing attempts or other forms of fraud.
The hockey federation also said it does not use AllUnited for its membership administration, but blocked data exchanges as a precaution following the incident. The KNVB, KNLTB, and several other federations had not issued public statements about the breach at the time of writing.
AllUnited said it would report the incident to the police. The company has not yet provided a precise count of the affected clubs or individual records. It said it regretted the situation and would take measures to further secure its systems.