Ajax football club hack exposed fan data, enabled ticket hijack

AFC Ajax disclosed that a hacker exploited vulnerabilities in its systems to access fan data (emails for a few hundred people and personal details for fewer than 20 individuals with stadium bans) and that RTL journalists verified the flaws could enable transferring season tickets, modifying stadium ban records, and potentially accessing details for hundreds of thousands of accounts. Ajax has patched the vulnerabilities, engaged external experts, and notified the Dutch Data Protection Authority and police; there is no confirmed large-scale leak or malicious exploitation reported.