Dutch police arrest man over cyber breach at Ajax football club

Dutch police arrested a 35-year-old man suspected of illegally accessing the computer systems of Ajax, one of the Netherlands’ most prominent football clubs.

The suspect was detained in the central Dutch town of Buren, where law enforcement officers also searched his home and seized multiple digital storage devices, according to a statement released Tuesday by the Dutch National Police.

“The man is suspected of intentionally and unlawfully entering Ajax’s computer systems multiple times,” police said. Authorities did not disclose the suspect’s identity or provide details about a possible motive.

The arrest follows a data breach disclosed by Ajax in March, when a hacker exploited an unpatched vulnerability to gain access to the club’s systems. At the time, Ajax said the intrusion exposed the email addresses of several hundred individuals and limited personal information belonging to a small number of people subject to stadium bans. The vulnerability also could have allowed the attacker to transfer tickets and alter stadium-ban records, the club said.

Dutch broadcaster RTL previously reported that the scale of the breach may have been significantly larger. RTL said the incident potentially exposed personal information belonging to more than 300,000 registered Ajax supporters and could have affected more than 42,000 season tickets.

Following the breach, Ajax said it had patched the vulnerability and launched an investigation.

Sports organizations have increasingly become targets for cybercriminals seeking financial gain. In 2024, Italian soccer club Bologna FC 1909 disclosed a ransomware attack that resulted in the theft of company data, including financial documents, player medical records and confidential employee information.

Other recent incidents have affected Paris Saint-Germain FC, which reported a cyberattack targeting its online ticketing service in 2024, and Manchester United FC, which suffered a ransomware incident in 2020. 

National football associations have also faced attacks. The Royal Dutch Football Association experienced a ransomware incident in 2023, and the French Football Federation disclosed a cyberattack in 2025.