Ajax Taraftar Sistemleri Data Incident (2026)
The 2026 Ajax data incident is the event Ajax disclosed on March 25, 2026, involving unauthorized access to supporter systems and limited viewing of data.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
4- Email addresses
- Names
- Dates of birth
- Stadium-ban records for a narrow viewed subgroup
About This Breach
Public sources do not establish the initial-access date or an affected-person count, so March 25 is a disclosure date rather than the incident start; a zero metadata value does not mean nobody was affected.
The confirmed classes are emails, names, dates of birth, and stadium-ban records. The stadium-ban attribute relates to the narrow group of fewer than 20 people whose records were reportedly viewed; it must not be generalized to all Ajax supporters or the wider technically reachable population.
Approximately 300,000 accounts, 42,000 tickets, and 538 ban records describe the widest potentially reachable system context, not confirmed victims, viewed records, or exfiltrated data. A controlled executive-ticket transfer demonstrated broader access potential but does not prove that every ticket was taken. No person-level data is locally imported.
The record does not establish identity, Ajax supporter status, ticket or season-ticket ownership, a stadium ban, field co-occurrence, account takeover, or misuse. Ajax-themed ticket or rights requests should be verified through an independent official club channel without using links in the message.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
