2026 AllUnited — software flaw; club member IBANs copied
Data compromised
Admin users: names, emails, phones, encrypted passwords (and how the encryption worked). Members, former members, volunteers: names, addresses, birth dates, phones, emails, IBANs, free notes, readable temporary passwords that had not been changed. Website enrolments: names, contacts, birth dates, IBANs. Passwords being reset. recordsAffected 0.
Technical writeup
AllUnited 9-12 Nov customer notices. 350 clubs is a reporter count of AP filings, not a people census. Do not invent a member total.
Root cause
On the evening of 9 November 2026 an outsider abused a software flaw through a club-website enrolment form, reached an AllUnited server and copied the company database. All clubs and federations on the platform. Found and closed 10 November. Reported to Autoriteit Persoonsgegevens. Police report. No people census. Morning Dutch: more than 350 clubs had reported by 12 November.