The EFL has issued an alert to clubs following a series of cyber attacks which have seen breaches at both Bristol City and Sheffield Wednesday in recent weeks.
Mail Sport understands such is the seriousness of the situation that panicked sides have enlisted the help of external agencies as they seek to deal with what is an increasingly troubling issue.
Hackers are targeting many of the competition’s bigger clubs, hunting for the personal data of season ticket holders and those on email lists. Should they be successful, that information, which can include passwords, is often sold on to a variety of buyers which are thought to include organised crime networks who can then attempt to use the data to carry out a variety of scams.
Earlier this month multiple emails were sent from senior officials at both the Robins and the Owls. They included links and, despite coming from official addresses, were actually the work of hackers who had managed to get into both clubs’ systems.
The EFL quickly sent an alert to all clubs following the issues at Bristol City, warning them not to open emails from Bristol Sport chief financial officer Vicki Long.
Mail Sport understands such is the seriousness of the situation that panicked sides have enlisted the help of external agencies
A similar situation unfolded at Wednesday, with suspicious emails sent from the account of finance director John Redgate. Both clubs were quick to respond and raise the alarm with those impacted.
Earlier this month, League One Charlton Athletic contacted police after they were hit. EFL bosses have told clubs that the problem is growing and urged them to increase vigilance given the sensitive data that they hold.
Leeds United appear to be among those leading the response. The club’s information security manager, Graham Peck, is creating a list of cyber security contacts at each side to ensure information is shared and to aid prompt responses.
In May, Aston Villa launched an investigation into reports of a data breach. While they found a vulnerable area, which they then closed, they did not find evidence of unauthorised access or sharing of passwords.