In early 2026, Ajax Amsterdam's IT systems were compromised multiple times by an attacker who exploited security vulnerabilities to gain unauthorized access. The attacker accessed personal data of hundreds of individuals, altered stadium bans, and transferred tickets. The vulnerability also exposed APIs and shared keys, allowing large-scale manipulation of fan data, including 42,000 season tickets and 538 stadium bans. Following the incident, Ajax patched the vulnerabilities and involved law enforcement. The Dutch National Police arrested a suspect linked to these intrusions in May 2026.

The breach exposed personal data of several hundred individuals associated with Ajax Amsterdam. It allowed unauthorized modification of stadium bans and ticket transfers, potentially undermining security and operational controls at the club. The vulnerability also permitted broad unauthorized access to fan data, including the ability to reassign VIP season tickets and manipulate tens of thousands of season tickets and hundreds of stadium bans. This could lead to privacy violations and disruption of ticketing and stadium security policies.

Ajax Amsterdam has patched the vulnerabilities exploited in the attack. The Dutch Data Protection Authority and police have been notified. Organizations should verify that all patches are applied and monitor for any signs of unauthorized access. Since the vulnerabilities have been addressed by Ajax, no further immediate action is required beyond ensuring patch deployment and compliance with data protection regulations.