Twizzit Data Breach Hits 1.2 Million Belgian Users
A major data breach has struck Twizzit, a Belgian software platform used for membership management by sports federations, clubs and youth organisations, exposing the personal data of members including minors. According to VRT NWS, the platform serves more than 5,500 organisations and roughly 1.2 million users, and the fallout extends well beyond any single client.
The attack came to light on 26 September, when Twizzit notified affected organisations that an unauthorised party had accessed and copied personal data. Among those confirmed as affected are the Flemish youth movements Chirojeugd Vlaanderen (about 107,000 members) and KLJ (more than 20,000 members), along with the choral federation Koor & Stem, which represents more than 1,000 choirs and roughly 35,000 members.
What Was Stolen
The data copied in the breach consists primarily of first and last names, email addresses and profile photos, where members had set them. Critically, Twizzit says no passwords, bank account numbers or payment information were leaked.
“Our partner Twizzit has informed us of a data breach in which personal data of our organisation may be involved,” said Marij Germijns, spokesperson for Chirojeugd Vlaanderen, as reported by VRT NWS. “Twizzit assures us that no bank or phone data was stolen.”
Because the affected youth movements concentrate information on minors, the incident raises particular safeguarding and privacy concerns, even without financial data being exposed. Chirojeugd Vlaanderen said it is not yet clear exactly how many of its members were affected.
How the Attack Happened
The owner of Twizzit, the UK-based holding company Invincible Software Holdings (ISH), confirmed the breach to the Belgian news agency Belga. In a statement, the company described how the intrusion occurred.
“We discovered that an unauthorised party used a valid Twizzit login to exploit a vulnerability in our platform,” ISH said, according to De Morgen. “The unauthorised party thereby gained access to data that should not have been accessible via a Twizzit account. Our investigation showed that personal data was also copied.”
The company said it has since stopped the attack, patched the vulnerability and introduced additional security measures. It has filed a complaint with the Centre for Cybersecurity Belgium (CCB) and is notifying affected organisations directly. The investigation remains ongoing.
A Wider Supply-Chain Problem
The breach illustrates a structural risk of multi-tenant software-as-a-service platforms: a single vulnerability can expose data across thousands of client organisations that run no servers of their own. Twizzit is used by federations across sports including athletics, badminton, cricket, karate, korfball, rugby and indoor football, as well as by OKRA-Sport+, the multisport federation for seniors.
Beyond Chiro, KLJ and Koor & Stem, data from members of sports federations such as Rugby Vlaanderen and Hockey Vlaanderen may also have been leaked, according to De Morgen. Chirojeugd’s Germijns noted plainly that “other clubs and federations are also involved.”
Not every partner was dissatisfied with the response. Jeroen Keymeulen, director of Koor & Stem, praised the handling of the incident. “We were informed immediately and were well guided in informing our members,” he told VRT NWS.
Why the Stolen Data Still Matters
The compromised information may look limited, but the combination of names, email addresses and photographs is well suited to credible phishing and social-engineering attacks. Chirojeugd Vlaanderen and Twizzit urged members to be alert to fraudulent emails, phone calls and messages in which criminals try to extract money or bank card codes, warning that the stolen data could make such attempts far more believable. Several Flemish sports clubs using the platform sent similar warnings to their members.
TVL reported that the youth movement told members it had taken steps to stop the attack and close the vulnerability.
Analysis: A Shift in Method
Cybersecurity experts say the Twizzit case reflects a broader change in how attackers operate. Rather than the classic ransomware playbook, in which intruders paralyse a network and demand payment, some attackers now quietly extract large volumes of data using legitimate credentials.
According to the Brussels Times, the breach is likely to extend well beyond any single affected organisation, given Twizzit’s stated footprint of more than 5,500 organisations and 1.2 million users. That scale turns a platform-level vulnerability into a supply-chain problem touching youth groups, choirs and sports clubs alike.
Under the EU’s General Data Protection Regulation, organisations that suffer a breach involving personal data are expected to notify the relevant data protection authority. Public reporting so far confirms only that ISH filed a complaint with the CCB; no filing with Belgium’s data protection authority, the Gegevensbeschermingsautoriteit, has been publicly confirmed.
What to Watch For
Three questions remain open: the true number of people affected, which has not yet been published; whether Belgian privacy regulators will open a formal investigation; and how Twizzit’s 5,500-plus client organisations will adapt their own data-handling practices in response.
For now, the practical advice from the affected organisations is simple: treat unexpected emails, calls or messages asking for money or bank details with heightened suspicion. For a platform trusted with the data of well over a million people, many of them children, the breach is a reminder that convenience and centralisation carry their own risks.