Italian football club targeted by hackers, company data stolen

Bologna FC 1909, a professional Italian football club, has become victim of a ransomware attack, which was most likely carried out by the RansomHub ransomware group.

In a brief statement, the Bologna-based football club acknowledges it was recently targeted by a ransomware attack on its internal security systems.

“The crime resulted in the theft of company data which may appear online. Please be warned that it is a serious criminal offence to be in possession of such data or facilitate its publication or diffusion,” the Italian football club says.

That’s all the information Bologna FC 1909 wants to share publicly about the incident.

Although not confirmed, the RansomHub ransomware group claims responsibility for the attack. In a message on the dark web, the attackers state that the football club was hacked “due to lack of security of their network”.

RansomHub declares to have exfiltrated all the club’s data, which is 200 gigabytes in size, including:

• Sponsorship contracts and documents revealing sponsor details and conditions;
• Financial data spanning the club’s entire history;
• Personal and confidential data of players, fans, and employees;
• Transfer strategies, including plans for new and young players;
• Medical records of players and staff;
• Confidential data related to stadiums and other structures;
• Commercial strategies and business plans; and
• Documents that could potentially violate FIFA and UEFA regulations, including financial fair play.

No samples have been provided to prove the data breach took place. The ransom deadline was set to November 29.

Bologna FC 1909 isn’t the first sports organization that’s being targeted by hackers. In April 2023, the now-defunct LockBit ransomware gang attacked the Royal Dutch Football Association (KNVB), the governing body for all football-related matters in the Netherlands.

LockBit claimed to have stolen 305 gigabytes of confidential information, including full names, home addresses, contact information, bank account numbers, medical data, copies of passports and contracts, secretariat documents, and confidential documents on disciplinary cases of players of the Dutch national team and other professional soccer players.

In September 2023, the KNVB announced it had paid the ransom demand to the hackers, which allegedly was around one million euros. The Dutch data protection authority (DPA) wasn’t exactly thrilled when they found out.

“If you pay a ransom, you have no guarantee that cybercriminals will not resell your stolen data after all. Moreover, this way you maintain a reprehensible revenue model that undermines people’s privacy,” the privacy regulator said at the time.