AllUnited, a Dutch membership administration platform used by thousands of sports clubs and dozens of national sports federations, has confirmed that an outsider copied personal data from its database in a cyberattack on the evening of Monday, November 9, 2026. The company says the breach covers the data of all clubs and federations on the platform, and more than 350 clubs had already reported the incident to the Dutch Data Protection Authority by Wednesday, according to reports.
The Noordwijk-based company sells software that clubs use to run memberships, subscriptions, payments, bookkeeping, registration forms and invoicing. Its website says it is trusted by more than 2,500 communities and lists 35 connected federations.
How the attacker got in
In a statement on its incident page, AllUnited said the outsider abused a bug in its software through the registration form on a club website. That gave the attacker access to one of AllUnited’s servers, which was then used to copy data from the database.
AllUnited said it discovered the intrusion on Tuesday, November 10, and fixed the flaw the same day. It emailed every club and federation on the platform at 7:15 PM local time that evening with details of what happened and what they needed to do.
The company has not named the vulnerability, and no threat actor has publicly claimed the attack. An AllUnited spokesperson said the company has had no contact with the attacker, so it is unclear where the attack came from or what the motive was, according to reports.
What data was taken
AllUnited listed three groups of affected people and the data copied for each:
- Administration users: name, email address, phone number and encrypted password.
- Members, former members, volunteers and other contacts: name, address, date of birth, phone number, email address, IBAN bank account number and any other fields stored on the member record, including free-text notes and temporary passwords.
- Sign-ups through club websites: name, email address, phone number, date of birth and IBAN.
The sample notice that AllUnited gave clubs to send to members also lists place of birth, AllUnited login details, and record fields such as member number, team and role. For youth members, the exposed data belongs to the child.
AllUnited said passwords were stored encrypted, but the attacker also took information on how that encryption works, so the passwords could be recovered with enough time and computing power. The company is invalidating all passwords. Temporary passwords that members had not yet changed were stored in readable form and are being deleted.
According to the company’s FAQ, the breach includes anyone still listed in a club’s administration, such as former members, parents, volunteers and sponsors. People whose records had already been anonymized were not affected. AllUnited said there is no sign that documents, photos or invoices were taken, and that it does not store Dutch citizen service numbers (BSN).
Federations and clubs confirm impact
The Royal Dutch Cricket Association (KNCB) told members that the data of all players in its AllUnited system was taken. The Royal Dutch Billiards Association (KNBB) published a member notice saying it reported the breach to the regulator and filed a police report, and that its scoring systems were not affected.
Rugby Nederland said AllUnited confirmed to it directly that this was a real hack and that it is also reporting the breach itself. The tennis and padel federation KNLTB said part of its clubs use AllUnited. The draughts federation has also confirmed it was affected, along with local clubs including football club VV Katwijk, VOC Rotterdam, Nijmegen Atletiek and Haagsche Rugby Club, according to reports.
Several federations that do not use AllUnited for their own records cut their data links as a precaution. AllUnited said its API connections with KNLTB, KNGU, KNSB, the Atletiekunie and KNHB have been switched off since Wednesday, November 11. The skating federation KNSB said it temporarily blocked its AllUnited link because many of its clubs use the platform. The football association KNVB does not use AllUnited itself but has heard from several football clubs that were hit, according to reports.
Hundreds of reports to the regulator
AllUnited said it reported the breach to the Autoriteit Persoonsgegevens (AP) and is filing a police report. Because each club controls its own members’ data, clubs must also report the breach in their own name. A spokesperson for the AP said more than 350 clubs had done so by Wednesday and that the number is expected to rise, according to reports.
After talks with the AP, AllUnited offered to file those reports for clubs that give written permission, and plans to submit them on Friday, November 13. Clubs that want to report on their own must do so by that day through the AP’s breach reporting page. AllUnited also set up a ready-made selection in its software so clubs can email every affected member at once. Heavy demand slowed outgoing emails and password reset messages on November 11.
An AllUnited spokesperson said the company does not yet know how many people are affected and expects to have more precise numbers by the end of the week. The spokesperson added that the company had not seen signs of misuse of the data.
Phishing is the main risk
With names, addresses, birth dates, bank account numbers and club details in hand, criminals can send messages that look like they come from a member’s club, federation, bank or AllUnited. The KNCB and KNBB warned members about fake emails claiming a membership fee payment failed, messages asking members to log in through a link to check their birth date, and phone calls from people posing as a bank.
Members of affected clubs should:
- Set a new password through “forgot password” the next time they log in to AllUnited or the ClubApp.
- Change the password anywhere else the same password was used.
- Treat unexpected payment requests and login links with suspicion, even when they include real personal details.
- Contact their club directly using a known website or phone number, not the details in a message.
- Check bank statements for unknown direct debits, which Dutch banks let customers reverse.
Our guides on how to check a suspicious email safely and how to respond to a data breach notification walk through these steps in more detail.
Bank details of European gym members were also exposed in the earlier Basic-Fit data breach, and sports club data was targeted in the alleged George Brown Sports Clubs breach.
