IMPORTANT; Your KNCB data may be in the wrong hands

What happened?

On Monday evening, November 9, 2026, an unknown attacker exploited a flaw in AllUnited's software. As a result, he was able to copy data from the database. This involved data from all clubs that use AllUnited. AllUnited discovered the leak on November 10 and patched it the same day.

Which data is involved? 

• Name, address, and place of residence

• Email address and telephone number

• Date of birth and place of birth

• Account number (IBAN), if entered in AllUnited

• If you have an AllUnited account: your login details

• Other details in your member record, such as membership number, team, position, or comments

Are you a parent or guardian of a youth member? Then this also concerns your child's details.

What could the consequences be?

Criminals can use this data to mislead you. For example, they could:

• Send messages that appear to come from the Royal Dutch Cricket Association (KNCB) or AllUnited;

• Ask you to pay membership fees, a fine, or another amount via a link;

• Send a payment request;

• Impersonate you using your details.

What can you do?

• Be careful with payment requests.

• Change your password if you also use the password for AllUnited / the ClubApp / our member portal elsewhere. Your password with us will be reset; You will receive a separate message about this.

Below you can read what such fake messages might look like.

What are we and AllUnited doing?

• AllUnited has closed the leak.

• AllUnited is resetting all passwords and implementing additional security and checks.

• We have reported the data leak to the Dutch Data Protection Authority.

• Any measures taken by the association itself, for example: we are temporarily not sending payment requests via email.

Questions?

Please contact Emil Buijs, office manager of the KNCB, emil.buijs@kncb.nl. We are sorry that this happened. We will keep you informed if there is new information.

2. How phishing works: explanation for clubs and members

The examples below are fabricated, as are the names and amounts.

Why this is happening now

For every member, the attacker has the name, address, date of birth, telephone number, email address, bank account number, and club. With that data, he can create messages that look just like a message from your club or your bank. People fall for that much faster than a sloppy spam email.

Example 1: an email ‘from the club’

From: Membership Administration VV De Zwaluwen ledenadministratie@zwaluwen-leden.nl

Subject: Your membership fee has not been debited

Dear Sanne de Vries,

The debit of your membership fee (€ 87.50) from your account NL•• •••• •••• ••12 34 was unsuccessful. Please pay within 48 hours via the link below. Otherwise, your membership will be terminated and you will no longer be able to participate in the training on Tuesday.

[Pay now]

What is wrong:

• The sender address looks like that of the club, but it isn't.

• It contains real data: your name, the last digits of your account, and your training day. That proves nothing, because that data has been stolen. • There is urgency (‘within 48 hours’) and a threat (‘membership terminated’).

• The link leads to a payment page belonging to the scammer, not the club.

Example 2: an SMS or WhatsApp

Hi Sanne, this is Mark from the membership administration at De Zwaluwen. Your date of birth 14-03-1988 is incorrect in our system. Could you please log in via this link to verify it?

What is incorrect:

• The club never asks you to log in or ‘verify’ something via a link.

• The fact that the sender knows your date of birth does not make the message genuine.

Example 3: a phone call ‘from the bank’

Someone calls and claims to be from your bank. He mentions your name, address, and account number and says there are suspicious transactions. To secure your money, you must provide a code or transfer money to a ‘safe account’. 

What is wrong:

• A bank never asks for codes and never lets you transfer money to another account. Hang up and call your bank yourself, using the number on your card or the website.

The four rules

1. Your club never asks for your password, a code, or your account number via email, SMS, or WhatsApp.

2. In doubt? Do not click on the link, but go to your club's website yourself or call the club.

3. Check your account for debits you do not recognize. You can reverse a direct debit in your banking app: within 8 weeks without reason, and within 13 months if you never authorized it.

4. Paid or entered something anyway? Call your bank immediately and report it to the Fraud Helpdesk.