AllUnited registration form flaw exposed club member data and credentials
AllUnited says an attacker used a club registration form to reach a server and copy membership data, including IBANs and credentials. The provider fixed the flaw and announced a password reset. It has not published a count of affected individuals.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Clubs, federations and communities using AllUnited, including their members, administrators and website registrants.
- AllUnited · SaaS · data breach
- In the wild
- Yes
- AllUnited confirms a software flaw was exploited and database records were copied.
What happened
AllUnited says an attacker exploited its software through a club website registration form on November 9. The attacker reached one server and copied database data for clubs and federations on the platform. The provider says it found and fixed the flaw on November 10. It did not identify a CVE or publish an affected software version.
Administrative records included names, emails, phone numbers and passwords the provider describes as encrypted. AllUnited says the attacker also obtained information about how that protection worked. Unchanged temporary passwords were stored in readable form. Member records could include addresses, dates of birth, contact details, IBANs and free-text notes. Website registrations included contact and birth details and IBANs. The fields vary by record. The Dutch cricket association says the records of all players in its AllUnited system were copied and that it reported the breach to the regulator. AllUnited said hundreds of organizations authorized a joint filing by November 12; that is not a count of individuals. The published notices do not establish account takeovers or financial losses.
Crime-scene timeline
Nov 9, 2026
An attacker reaches an AllUnited server through a club registration form
AllUnited says the attacker copied data from its database.
Nov 10, 2026
AllUnited detects and fixes the flaw and notifies customer organizations
It reports the breach to the Dutch Data Protection Authority and announces password invalidation and removal of readable temporary passwords.
Nov 11, 2026
Password reset delivery resumes after delays
AllUnited reports the email backlog cleared. It also temporarily disables API links to five sports federations.
Nov 12, 2026
AllUnited updates the coordinated reporting process
It gives clubs separate November 13 cutoffs for authorizing its joint filing or submitting their own report.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- AllUnited incident timeline and FAQPrimaryConfirms the entry point, data copied, password handling and organization notification process.
- AllUnited Customer Care Center noticePrimaryDirects customers to the official incident and response page.
- Royal Dutch Cricket Association (KNCB) member noticePrimaryConfirms that the records of all players in its AllUnited system were copied.