Sports club member data stolen through a flaw in AllUnited software

An attacker has copied the personal data of members of every sports club and federation that uses AllUnited, the membership software company said on its website. Many Dutch clubs use AllUnited to keep their member lists.

What happened

On Monday evening, 9 November, an outsider abused a flaw in the AllUnited software. Through the sign-up form on a club website, the attacker got access to one of the company’s servers and copied data from its database. AllUnited says it found the leak on Tuesday 10 November and closed it the same day. It has reported the data breach to the Dutch Data Protection Authority and is filing a police report.

Which data

For members, the stolen data includes name, address, date of birth, phone number, email address and bank account number, as well as other fields in the member record, such as notes. For sign-ups through club websites, it includes name, email address, phone number, date of birth and bank account number. According to AllUnited’s sample letter for clubs, parents and carers of youth members should know that their child’s data is involved too.

Passwords were stored encrypted, but the attacker also took information on how that encryption works. AllUnited is therefore making all passwords invalid. Temporary passwords that members had not yet changed were stored in readable form and are being deleted.

What you can do

Criminals can use the data to send messages that seem to come from your club, your federation or AllUnited, for example asking you to pay a membership fee or a fine through a link. Be careful with such payment requests. If you used the same password for AllUnited, the ClubApp or your club’s member portal anywhere else, change it there too. Your AllUnited password is being reset, and you will receive a separate message about it.