Ticketmaster Data Hack Hits Half a Billion Customers

In this story

Personal information imperiled • Hackers brag • Assume the worst • Fight back

Your name, address, credit card, email and other personally identifiable information may have been exposed if you bought tickets online to a concert, Broadway show or sporting event through Ticketmaster.

On May 31, Ticketmaster’s parent company, Live Nation Entertainment, revealed in an 8-K filing with the federal Securities and Exchange Commission that about a week and a half earlier, it had discovered unauthorized activity regarding Ticketmaster data. A public company files an 8-K when an unexpected major event occurs of interest to shareholders and investors.

Live Nation’s investigation found that the data was for sale on the dark web, the secretive corridors of the internet where criminals barter illegally obtained consumer information.

Hacker group claims to be responsible

The regulatory filing appears to confirm claims from a hacker group known as ShinyHunters that it was responsible for the theft, which reportedly amounted to 1.3 terabytes of personally identifiable information on 560 million Ticketmaster customers. The stolen data was said to carry a one-time price of $500,000.

ShinyHunters may also be behind a recent data breach at Santander Bank, based in Spain but with branches in Florida and eight mid-Atlantic and New England states. Data from some 30 million bank customers was exposed as part of that hack.

Other reports suggest that the cyberattacks may have been launched against a cloud-hosting provider named Snowflake that large companies use to store mountains of data. In the SEC filing, Live Nation-Ticketmaster didn’t mention Snowflake.

Nor did Snowflake mention Live Nation-Ticketmaster in a blog post that read in part, “We have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration or breach of Snowflake’s platform.” But it also acknowledged, “We did find evidence that a threat actor obtained personal credentials to and accessed demo accounts belonging to a former Snowflake employee. It did not contain sensitive data.”

Assume the worst about your data

“I think it is fair to assume that your info has been exposed from at least one of these mega-breaches we’ve had in recent years,” says Odysseas Papadimitriou, chief executive of the WalletHub mobile app and personal finance site. “The Ticketmaster breach is not only the latest, it’s a huge one.”