AllUnited membership system breach — 350+ Dutch sports clubs expose member personal data
Severity: medium · Patch status: no-fix-needed · Since 2026-11-11
A cyberattack on Monday evening hit AllUnited, a Dutch membership administration system used by sports clubs, exposing members' personal information. More than 350 Dutch sports clubs have reported the breach to the Dutch Data Protection Authority (AP), with the number of reports expected to rise further. Affected clubs' members may have had personal data compromised. Details on attack vector, exact data types exposed, and attacker identity are not yet stated in the source. As a breach of a hosted service, no vendor patch applies; incident response and notification obligations under GDPR are in play.
What to do
- Clubs using AllUnited should verify with the vendor whether their member data was affected and notify members as required under GDPR
- File or update a breach report with the Dutch Data Protection Authority (AP) if not already done
- Monitor for phishing or fraud targeting members whose contact details may have been exposed
- Review AllUnited account credentials and enable MFA where available
- Follow vendor guidance on securing or resetting club administration accounts
Sources
All live incidents on Threat Watch
