AllUnited Breach Exposes Club Member Data and IBANs

Members of Dutch sports clubs on the AllUnited platform should treat unexpected payment requests, contribution notices and messages that appear to come from their club as hostile until they have checked them by a separate route. AllUnited, which provides membership administration software to clubs and federations, says an outsider abused a flaw in its software on the evening of Monday 9 November 2026, used a sign-up form on a club website to reach one of its servers, and copied data from the database. In a live incident notice last updated at 15:00 CET on 11 November (14:00 GMT), the company said the copy covered “the data of all clubs and federations in AllUnited.”

The company says it found the flaw on Tuesday 10 November and closed it the same day. It has reported the breach to the Dutch data-protection authority, the Autoriteit Persoonsgegevens, and says it is filing a police report. The Dutch tennis federation, the KNLTB, issued its own notice on 11 November, saying unauthorised persons had gained access to players’ personal data through the supplier.

AllUnited has not published an official count of members or of clubs. Figures circulating in the Dutch press are not used here. It has not named an attacker, and it has not described a ransomware demand.

AllUnited says IBANs, notes and temporary passwords were taken, and that password encryption was explained to the attacker

The company’s own inventory is already serious enough. For administrative users, it lists name, email address, telephone number and an encrypted password. For members, it lists name, address, date of birth, telephone number, email, IBAN and the other fields stored on a member record, “including free notes and temporary passwords.” Sign-ups through club websites, it adds, also included IBANs.

The encrypted administrator passwords are not a complete comfort. AllUnited says the attacker “also took how that encryption works,” and that with enough time and computing power the passwords could still be recovered. It is therefore resetting all passwords. Temporary passwords that members had not yet changed “were stored in readable form,” and the company says it is wiping those. Password-reset mail has been going out in bursts; on 11 November AllUnited warned that thousands of messages were queued and that people should request a new password only once.

The practical risk the company itself puts first is fraud against members, not a second intrusion into the software. In the sample letter it has given clubs to send, it warns that criminals can impersonate the club, the federation or AllUnited, ask for a contribution, a fine or another payment through a link, send a payment request, or pose as the member. “Watch out for payment requests,” the template says, in those words.

Clubs and federations have their own notification duty. AllUnited said at 12:25 CET on 11 November that it was discussing with the Autoriteit Persoonsgegevens whether it can be authorised to notify on behalf of all of them. The deadline it published for those notifications is Friday 13 November at 19:15 CET, which is 18:15 GMT. It asked clubs to wait for a further message the same day, but to keep that deadline in view. This post does not assume that a single central filing has been agreed.

A copied membership file is a ready-made phishing kit

The harm in this incident is not abstract. A file that already contains a name, a club, an IBAN and free-text notes is raw material for a convincing payment request. That is why the warning belongs at the top of the story, and why password resets, while necessary, leave the fraud risk in place. The IBAN does not need to be decrypted. It is already in the copy.

Other recent breaches have followed the same pattern in different markets. Muji said an app breach may have exposed up to 27.26 million customer records. FirstVDS said attackers used a VMmanager flaw to copy customer data, another case in which a software flaw, not a ransomed system, produced a database copy. Club Tourism said a hack may have exposed 4.32 million member records, a membership-file leak with the same basic shape. A separate TSN report on SECRA, a HomeToGo unit, said hackers took booking data that may have included IBANs; that earlier post is cited here only in the body.

What AllUnited has not yet said is how many people sit in the copied file, or whether the attacker has used the data. Until clubs complete their notices, members are left with the company’s own advice: treat unexpected payment requests as hostile, change reused passwords, and use the newest reset mail if more than one arrives. The 13 November 18:15 GMT deadline is the next formal point on the calendar, not the end of the fraud risk.