Data breach at platform for sports clubs
An attacker exploited a software flaw in sports-club platform AllUnited.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
A data breach has been discovered at AllUnited, a platform for managing sports-club memberships. According to an affected sports club, an unknown attacker exploited a software flaw on Monday evening; the precise extent of the breach has not yet been made public.
AllUnited provides software for, among other things, membership administration, subscriptions and club communications. As a result, the system may contain personal data belonging to amateur athletes, volunteers and parents. It has not yet been established exactly which categories were taken.
De Haagsche Rugby Club reported that AllUnited discovered the breach on 10 November and closed it the same day. The club is warning members about messages that appear to come from the club or from AllUnited. This points to a possible phishing risk, but does not prove that the data has already been used for fraud.
A data breach means that personal data has been, or may have been, accessed without authorisation. It does not automatically mean that every registered person has been affected. Nor is it yet known how many clubs or people are involved in the incident.
For sports clubs, reliance on centralised platforms offers a practical advantage, but it also creates a concentrated risk. A single vulnerability can affect several clubs using the same software. Which organisation must inform those affected depends on its role in processing the data and the circumstances of the incident.
AllUnited must investigate the technical cause and extent of the incident further. Clubs will have to determine which members need to be informed directly and whether a report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is required. The publicly available information found contains no definitive overview on this.
The safe conclusion for now is limited: there was a security incident, the breach was closed according to the affected club, and there is a risk of misleading communications. Until AllUnited or a regulator publishes further information, the numbers and types of personal data taken cannot be reliably established.
Also show where in Europe and in the world
Fact-check Approved with corrections · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The existence of the incident and the time of its discovery were confirmed by an affected club. The extent and nature of the data taken remain uncertain and have therefore not been presented as fact.
Editor's note
The publicly available information confirms the incident through an affected club, but does not yet provide independent confirmation or a reliable assessment of its extent. The status is therefore insufficient_sources.Sources
- Belangrijk Bericht over datalek bij AllUnited — Haagsche Rugby Club
- Contact — AllUnited
More on this in Dutch media
- De Telegraaf — „datalek allunited”
- de Volkskrant — „datalek allunited”
- NOS — „datalek allunited”