Ajax Amsterdam, a professional soccer team from the Netherlands, announced that a hacker broke into its computer systems and saw personal information of a few hundred individuals.

The security flaws also made it possible to transfer tickets to other people and change stadium bans that were in place for certain fans.

The team found out about the security problems and what they could do from reporters who had been contacted by the hacker.

AFC Ajax is a very successful soccer team, having won the UEFA Champions League four times and the Eredivisie (the top Dutch league) 36 times.

“We recently learned that a hacker in the Netherlands illegally accessed parts of our systems. Data was looked at,” AFC Ajax announced.

“We now know that only the email addresses of a few hundred people were viewed. Also, the names, email addresses, and birthdates of fewer than 20 people with stadium bans were accessed.”

RTL journalists, who received a tip from the hacker, confirmed the vulnerabilities independently. They reported being able to move season tickets from their owners to anyone, change stadium ban records, and gain wide access to fan data through APIs and shared keys.

They showed how they could reassign a VIP season ticket in seconds. Most concerningly, RTL reported they could manipulate 42,000 season tickets, 538 stadium bans, and see details on over 300,000 accounts.

AFC Ajax says it has hired outside experts to figure out how big the incident was and what caused it, while saying that the exposed data hasn’t been leaked.

In the meantime, all the identified vulnerabilities have been fixed, and more security measures have been added.

The Dutch Data Protection Authority and the police have also been informed.

RTL’s investigation was clearly not malicious. Likewise, the attacker’s limited access and decision to tell the media about the flaws, instead of using them for money or extortion, suggest the vulnerabilities weren’t widely abused.

However, it’s still unclear if this was the first time these weaknesses in Ajax’s systems were found or used.

Ajax fans who have signed up with the team’s systems or bought season tickets should watch out for suspicious messages, especially those pretending to be from AFC Ajax.