The American Football Bond Netherlands (AFBN) has been affected by a large-scale data breach at the software provider AllUnited. In a cyberattack, personal data of members of various Dutch sports federations and associations was stolen. The AFBN has been informed about this and can therefore take the necessary follow-up steps to warn the affected parties and to limit possible damage. There are a total of 35 sports federations affiliated with AllUnited.
The security incident occurred on Monday evening, November 9. An unauthorized person exploited a vulnerability in the software of AllUnited, the system that is used, among other things, for member administration. Through that vulnerability, the attacker gained access to a server and was able to copy data from the database. AllUnited discovered the incident on Tuesday, November 10, and resolved the security flaw the same day. The supplier has now reported the data leak to the Dutch Data Protection Authority and has filed a police report.
What data have been stolen?
According to AllUnited, the personal data of all affiliated organizations is involved, including the AFBN and 34 other sports federations. Depending on the stored data, names, addresses, birth dates, phone numbers, email addresses, and bank account numbers (IBAN) can be accessed. Additionally, additional information from member administrative systems may be involved. Furthermore, encrypted passwords from users have been accessed. Although these were not directly readable, there is a risk that they may still be discovered. AllUnited has therefore decided to invalidate all passwords.
Careful follow-up important for the football community
For the AFBN and the affiliated associations, the priority is to limit the possible consequences for their members. The federation was informed about the incident by AllUnited and has received instructions regarding the necessary follow-up steps. In this context, the federation has given AllUnited the mandate to act on its behalf as well. The federation has undertaken to inform the affected members, AllUnited is responsible for the reporting obligations with the Personal Data Authority and is warning of possible fraud.
The biggest risk at the moment is phishing. In this case, criminals can send credible messages using the compromised personal data, which appear to originate from a sports club or the AFBN. For example, they might send fake membership requests or messages asking members to re-enter their account details.
Members are therefore advised to be alert to suspicious emails, text messages and payment requests. Anyone who has an AllUnited account should set a new password when logging in next time. If the same password is used elsewhere, it is advisable to change it there as well.
Safety of members comes first
The incident underscores the importance of careful handling of personal data, even within the Dutch American football community. Although the vulnerability was found within an external software provider, we hope that this communication will minimize the impact on members as much as possible. AllUnited has indicated that it will implement additional security measures and controls. In the coming period, it will be clear what the exact extent of the data breach is and what consequences this has for individual members.
For involved athletes, the most important advice for the time being remains: be alert to suspicious messages and always check payment requests directly with your association.