Dutch police arrest suspect for breaking into Ajax’s computer systems

Published: 28 May 2026

Anton Mous
Journalist

ajax football clb fans, men, red light, red steam, bald man, crowd hands up — Ajax celebrating victory during the Dutch Eredivisie match. Jeroen van den Berg/Soccrates/Getty.

The Dutch National Police have arrested a 35-year-old man for hacking the IT systems of professional soccer club Ajax earlier this year.

The suspect was arrested in the municipality of Buren on Tuesday, May 26th. He is suspected of intentionally and unlawfully intruding into Ajax’s computer systems multiple times.

Following the arrest, police searched the 35-year-old man’s home. During the search, various data storage devices were seized for further investigation.

No further details were shared.

Don't miss our latest stories on Google News. Add us as your Preferred Source on Google

Last March, Ajax disclosed that an ethical hacker had gained unauthorized access to the club’s IT systems, exposing the personal information of over 300,000 fans.

According to the club, only the email addresses of a few hundred people were viewed, along with sensitive and personal information belonging to fewer than 20 people with a stadium ban.

The vulnerability in the club’s internal network also allowed the unauthorized person to modify and remove stadium bans of 538 supporters.

Further investigation revealed that the names, email addresses, row and seat numbers, and barcodes of a group of approximately 400 people who hold tickets for the Ajax vs FC Twente, Ajax Women vs Feyenoord Women, and Ajax vs PSV matches were accessed.

Tess van Bentem, Ilayah Dostmohamed, black and white women playing football, green grass — Tess van Bentem of Feyenoord V1, Ilayah Dostmohamed of Ajax Women. ANP via Getty.

The ethical hacker who was responsible for the breach explained how he pulled it off. He said that every Ajax app user has the same digital key to make adjustments to their account.

“By manipulating a sent data packet, you can perform actions on someone else’s behalf, such as transferring a ticket,” he told Dutch news outlet RTL Nieuws.

In addition, Ajax used multiple software interfaces or APIs where the administrator’s digital key could be found.

“This way, an unauthorized person could gain access to all kinds of sensitive data belonging to Ajax fans and perform actions,” the ethical hacker said.