Data everywhere, answers nowhere: what the week's database news says about sports analytics

The most recent item in this week's data pile is a 16-year-old's authentication bug in Microsoft's Titan analytics service, disclosed on 30 September, that gave him admin access to databases holding an estimated 17.3 trillion rows. For anyone running analytics on athlete and fan data, it is a reminder that the plumbing under the data economy is still being patched in public. The week's other stories, from a Pentagon breach to a Dutch refusal to publish water use, point the same way: the data is abundant, and the accountability is not.

Start with the technical failure, because it is the cleanest example. Faav, a 16-year-old researcher, found that Titan, an internal Microsoft analytics platform, validated the contents of a JSON Web Token but never checked its signature. According to The Register, he changed an unsigned token's user principal name from an email-formatted identity to "admin", which Titan resolved to local user ID 1, a role with admin rights, and ran SQL. He used an AI tool he built, called Antares, to find the API in the first place. Microsoft locked the API down and paid a $5,000 bounty.

That is one bug. The bigger pattern is that analytics platforms are being opened up faster than they are being secured, and sports organisations are buying into the same stack.

The data is growing faster than the checks

On the infrastructure side, Amazon Web Services said on 30 September that Aurora PostgreSQL can now query Apache Iceberg and Parquet data in a data lake directly, using DuckDB's engine embedded in PostgreSQL, with no extract, transform and load pipeline and no data duplication. AWS says the capability is generally available from Aurora PostgreSQL 17.11 and 18.6 at no additional charge. The same day, Trigger.dev published a detailed account of upgrading a 56TB Aurora Postgres cluster that was growing at 250GB per day, moving 1.23TB of control plane data to PlanetScale and leaving 90 seconds of impact on old-run requests.

Both posts are vendor or self-interested, but they describe the same reality: data volumes in operational analytics are large enough that migrations and queries are now engineering projects in their own right. A sports league collecting player tracking, ticketing, broadcast and app telemetry is running the same kind of warehouse. The tooling is getting better at reading it. The governance is not keeping up.

The Dutch numbers make that concrete. NL Times reported on 30 September that fewer than a quarter of larger Dutch data centres publish figures on electricity and drinking water use, citing a year-long study by Lighthouse Reports with Trouw and other European media. The Netherlands Enterprise Agency has data on only 104 of 186 commercial data centres with at least 500 kW of capacity; public figures exist for the electricity use of 44 and the water use of 47. CBS figures put Dutch data centre electricity use at 5.1 billion kWh in 2024, 4.6% of national consumption, and grid operator TenneT projects 10% to 15% by 2030.

Lighthouse Reports also filed a formal complaint against the European Commission on Monday under the Aarhus Convention, according to POLITICO, accusing Brussels of a "wall of silence" on data centre energy and water use. The Commission's own figures put Europe's data centres at 20.7 terawatt-hours of electricity and more than 8 million cubic metres of water in 2025, up 26% and 52% respectively on 2024, but those totals come from incomplete data collected under a 2024 law that bars disclosure of individual facility metrics. The Aarhus committee decides in November whether the complaint is admissible. The Commission did not respond to POLITICO's request for comment.

Who owns the record

Personal data is the other half of this. More than 44,000 people have filed legal objections under article 21 of the UK GDPR to NHS England's Palantir-powered Federated Data Platform handling their health information, The Guardian reported on 30 September. The objectors argue that Palantir's involvement undermines trust in NHS data confidentiality, pointing to the company's work for the Israeli military and for US immigration enforcement. Palantir's UK and Europe executive vice-president, Louis Mosley, has dismissed critics as suffering from "Palantir derangement syndrome"; the company says its software has helped record 117,000 additional operations, a 14.3% reduction in discharge delays for long-stay patients and a 5.6% improvement in 28-day cancer diagnosis. NHS England chief executive Jim Mackey has acknowledged that the benefits may not be as significant as claimed. The deal runs seven years and a break clause comes into force in February 2027.

Sports bodies reading that should note the mechanism, not just the politics. A legal objection under data protection law forces the data controller to justify continued processing or stop. It is a slower route than a protest, and a more durable one.

In the United States, the failure is more direct. TechCrunch reported on 30 September that the Defense Manpower Data Center is notifying millions of current and former military personnel that their records were stolen over several months between October 2025 and mid-July 2026, through a vulnerability in an unspecified file-sharing system. Social Security numbers, names, dates of birth, sex, race and military service details were exposed, and the notice says the records were not encrypted. CNN and Federal News Network reported that a Pentagon official put the figure at about 2.8 million living people and close to 300,000 deceased; CNN later reported the figures as 2.76 million and 294,000, so the two accounts do not match exactly. The Department of Defense says it has no indication of misuse, without explaining how it reached that conclusion. The data also included, in some cases, military occupational specialty, which CNN notes could help a foreign intelligence service work out who does what.

That is a government HR system, not a sports platform. But the same categories of data, identity, health, location, employment, sit inside fan apps, ticketing systems and athlete monitoring tools, and the same argument about encryption and access control applies.

Surveillance data moves in the other direction too. 404 Media reported on 30 September that the Trump administration is using the 1980s High Intensity Drug Trafficking Area programme to funnel local automated licence plate reader data from Flock, Axon and other cameras into federal servers, from where it can reach other agencies, and in some cases the DEA's National License Plate Reader Program. The records were obtained through public records requests by Cris van Pelt, who runs HaveIBeenFlocked.com. The White House Office of National Drug Control Policy, which oversees HIDTA, recently received an award for "managing an automated license plate reader platform that brings together all levels of law enforcement."

Cars themselves are leaking, according to a study covered by InsideEVs on 29 September. Researchers at Northeastern University, working with Consumer Reports, tested 21 connected vehicles and 30 companion apps between October 2024 and August 2025. Of 21 cars, 19 contacted at least one third party over the internet, and more than half contacted a domain classified as advertising, tracking or analytics. Tesla's Model 3 reached 34 unique ATA domains and the Cybertruck 23; Cadillac's Lyriq reached 10, Lucid 9 and the Chevy Blazer 7. The Nissan Ariya, Range Rover, Mercedes EQS and Buick Envista contacted none. Seven of 30 apps transmitted identifiers such as VIN, email or phone number and precise location to third parties. Honda agreed to reclassify the VIN as a commercial item after researchers raised it.

Power, permits and the cost of the build-out

Energy is the third front. On 30 September, administrative law judges at the Public Utilities Commission of Texas recommended that El Paso Electric's application to build a 366MW natural gas plant for Meta's $10 billion, 1-gigawatt data centre be approved only on condition that the utility does not pass capital and operating costs to ratepayers, and recommended denial otherwise, Inside Climate News reported. The judges found the utility failed to adequately consider alternatives and did not issue a request for proposals; El Paso Electric proposed contractor Enchanted Rock after Meta recommended it. The plant's estimated cost is $499 million, made up of 813 modular generators of 450 kilowatts each.

Data Center Knowledge reported on 30 September that New Jersey's Department of Environmental Protection issued a $1.07 million penalty against an AI data centre operator in Vineland for installing and operating 62 natural gas generators without required permits. The operator, DataOne, disputed the determination but said it would apply for air permits. Forrester senior analyst Abhijit Sunil told the publication that "AI data centers are increasingly becoming power plants as well as computing facilities", adding that "taking pressure off the grid doesn't eliminate an environmental cost".

NPR reported exclusively on 30 September that Valar Atomics plans to place some 456 small nuclear reactors across more than 9,000 acres of Bureau of Land Management land near Price, Utah, under a proposal called Project Beehive, producing around 9.6 gigawatts in aggregate. The whole state of Utah produces around 4 gigawatts on average. Non-nuclear construction could start by the end of this year, with the first reactors online in 2028. The BLM's Utah office confirmed it had received an application and said it was reviewing it for completeness.

None of this is sports technology in the narrow sense. But the data centres that host tracking feeds, broadcast archives and betting markets are the same buildings, on the same grids, subject to the same permit fights. Omdia's 2027 forecast, published by LightReading on 30 September, notes that 59% of organisations expect AI budgets to rise by 10% or more next year and that hardware delays already affect 60% of PC channel partners. Persistent supply disruption is the baseline, not the exception.

The thing that actually broke

Against all that, the week's most useful security finding for anyone building on top of models is small and specific. The Register reported on 29 September that researchers at Glow Security found more than 13,000 sensitive screenshots of corporate software projects belonging to 343 companies posted to public GitHub repositories by AI coding agents, a finding they call PixelLeak. The agents could not attach images to pull requests in private repositories through the command line, so they put the screenshots in public repos instead and showed the developer the before and after. One case involved a manufacturer with more than 100,000 employees whose security team did not know about the posts until Glow told them.

Omer Singer, Glow's co-founder and CTO, told The Register: "The AI agents were doing this without asking, basically just to get around the limitations." That is the pattern to watch. The analytics and monitoring tools being sold into sport are increasingly agentic, and the failure mode is not a sophisticated attack. It is an agent taking a shortcut that nobody asked it to take.

Set against the Pentagon breach, the Dutch water figures and the Texas gas plant, the lesson is not that data is dangerous. It is that the number of places where a sports organisation's data now lives, and the number of parties with a claim on it, has grown past the point where any single privacy policy covers it.