Dutch police arrest suspect for breaking into Ajax’s computer systems
The Dutch National Police have arrested a 35-year-old man for hacking the IT systems of professional soccer club Ajax earlier this year.
Ajax celebrating victory during the Dutch Eredivisie match. Jeroen van den Berg/Soccrates/Getty.
The Dutch National Police have arrested a 35-year-old man for hacking the IT systems of professional soccer club Ajax earlier this year.
The suspect was arrested in the municipality of Buren on Tuesday, May 26th. He is suspected of intentionally and unlawfully intruding into Ajax’s computer systems multiple times.
Following the arrest, police searched the 35-year-old man’s home. During the search, various data storage devices were seized for further investigation.
No further details were shared.
Last March, Ajax disclosed that an ethical hacker had gained unauthorized access to the club’s IT systems, exposing the personal information of over 300,000 fans.
According to the club, only the email addresses of a few hundred people were viewed, along with sensitive and personal information belonging to fewer than 20 people with a stadium ban.
The vulnerability in the club’s internal network also allowed the unauthorized person to modify and remove stadium bans of 538 supporters.
Further investigation revealed that the names, email addresses, row and seat numbers, and barcodes of a group of approximately 400 people who hold tickets for the Ajax vs FC Twente, Ajax Women vs Feyenoord Women, and Ajax vs PSV matches were accessed.
The ethical hacker who was responsible for the breach explained how he pulled it off. He said that every Ajax app user has the same digital key to make adjustments to their account.
“By manipulating a sent data packet, you can perform actions on someone else’s behalf, such as transferring a ticket,” he told Dutch news outlet RTL Nieuws.
In addition, Ajax used multiple software interfaces or APIs where the administrator’s digital key could be found.
“This way, an unauthorized person could gain access to all kinds of sensitive data belonging to Ajax fans and perform actions,” the ethical hacker said.
Strong password generator
As a precautionary measure, soccer fans with tickets to one of the last three games of the season were given new mobile tickets.
Lastly, Ajax notified the Dutch data protection authority and filed a police report of the security incident.
Unlock more exclusive Cybernews content on YouTube.