Ajax data breach exposed season tickets, supporter bans open to tampering

AFC Ajax disclosed that an unknown hacker exploited exposed APIs and shared access keys in its app and website to gain access to parts of its systems, obtaining email addresses of a few hundred people and sensitive details for fewer than 20 stadium-banned individuals; RTL reported the flaw could expose data for roughly 300,000 registered fans and allow theft or disabling of about 42,000 season tickets. The club patched the vulnerabilities, engaged external investigators, filed a police report, notified the Dutch Data Protection Authority, and advised supporters to remain vigilant for phishing.