Ticketmaster hacked. Breach affects more than half a billion users. | Mashable.
Ticketmaster hacked. Breach affects more than half a billion users.
 |
| Notorious hacker group ShinyHunters is claiming to have hacked Ticketmaster, stealing more than 500 million customers' sensitive data. Credit: Joe Raedle/Getty Images |
To its critics, it seems Ticketmaster may be experiencing some karma lately for years of being the bane of concertgoers' existence. Unfortunately its latest hassle — a massive data leak — also negatively impacts consumers.
Just last week, the U.S. Justice Department filed an antitrust lawsuit against the ticketing conglomerate. The DOJ is seeking to break up the alleged monopoly its parent company, Live Nation Entertainment, holds over the live music and entertainment industry – potentially a good thing for consumers.
But Amid this nightmare for the company, a hacker group is now claiming to have stolen more than 500 million Ticketmaster customers' data in an attack.
Originally reported by cybersecurity outlets like Hackread and Cyber Daily, The "notorious hacker group" ShinyHunters is claiming responsibility for the breach affecting roughly 560 million Ticketmaster customers. The hacker group is selling the 1.3 terabyte-sized trove of data for a one-time price of $500,000 on a popular hacking forum.
What Ticketmaster data was stolen?
According to ShinyHunters, this is an immense trove of sensitive user data.
The group allegedly has Ticketmaster customers' full names, addresses, phone numbers, email addresses, and order history information including ticket purchase details and Ticketmaster event information.
In addition, hackers also allegedly have customers' partial payment data which includes names, the last four digits of their credit card numbers, and card expiration dates.
Again, this sensitive data is connected to roughly half a billion users.
Mashable has reached out to Ticketmaster and will update this piece when we hear back.
How did this happen?
As of the publishing of this article, it's unclear exactly how ShinyHunters carried out its attack. Ticketmaster has yet to comment on the situation or corroborate the hackers' claims.
However, Australia's Home Affairs Department has confirmed a "cyber incident impacting Ticketmaster customers." Due to the time frame in which the hackers shared their breach, it appears Australian outlets were the first to cover the news.
Ticketmaster has struggled with bad actors online using bots and other methods to disrupt the ticketing service and scoop up tickets to resell. The company also has a history of being the bad actor itself when it comes to electronic data. In 2020, the company agreed to pay $10 million to rival ticketing company SongKick after individuals on Ticketmaster's payroll obtained login credentials and gained unauthorized access to its competitors' computers.
As for ShinyHunters, Mashable has had a prior run-in with the hacker group as the company was once a victim of its attacks in 2020. ShinyHunters was able to breach a database connected to a since-disabled Mashable feature that allowed readers to login to the site with their social media accounts from services like Facebook. The stolen data included information like email addresses but did not include more sensitive data like passwords or financial details.
According to ShinyHunters, the group attempted to contact Ticketmaster about the breach but have yet to receive a response.
Topics Cybersecurity Music Taylor Swift
I'm Giving out 5 Grand To The First (10) People To Message Me With "HARD TIME" Cus
ReplyDeleteI Feel People Are Going Through Hard Times
Rn !!!! Stay Blessed Y'all❤️😇
Go to official webster support on Instagram, he will help you restore your account.https://instagram.com/websterofficialsupport...
ReplyDeleteAs A Way Of Helping Out Those Facing Challenges This Year, I'm Giving Away Five Grand To Seven Individuals Who Write To Me Using The Phrase "Support Me."
ReplyDeleteBastards...
ReplyDeleteUgh...
ReplyDeleteI feel sad saying this: I don't think it's right, but I worry less and less about these as time goes on; Not because I don't think it sucks, but because my information has been in so many breaches up to this point that I'm not sure what value there is left in any data that might appear in subsequent breaches.
ReplyDeleteThat was my reaction. I assume my identity information is available for sale from multiple breaches already at this point.
DeleteIt would take more personal information for me to really care (private messages, emails, social network interactions).
Unless there are lawsuits most people will forget about this breach in a week.
There is a bit of a security through obscurity effect when a breach affects 5-10% of the population.
Deleteunless someone is specifically looking for you.
Deleteimagine being a young woman with a stalker
ReplyDeletearesant 1 hour ago | prev | next [–]
Interesting this is marketed for $500k as a "One Time Sale" (1)
I find the "honor amongst thieves" part so interesting in these breach stories
(1) Troy Hunt, via an "X" user has a screenshot to the actual sale -> https://x.com/troyhunt/status/1795551650553491870
There's no sales_ord_delux_hdr/1... also sales_ord_delux_hdr/0 is the smallest partition... that's strange :/
DeleteAt 2.6 megabytes per dollar, it is at least cheaper than the price of a (very legal) kdb license, which can hover around 3 bytes per dollar.
DeleteComparing apples and oranges here but I like thinking about the monetary value assigned to a byte.
If this is real, you'd hope for Ticketmaster to come in clean and purchase it back.
DeleteWould be ironic if someone else bought it and sold it to Ticketmaster at a significant markup
DeleteAlthough I doubt they would buy it back, their customers all hate them, they have the worst reputation, and they've never given any shits about that. So I don't think they'll do any of that anyhow.
Delete$500k for 1.3TB, any idea how that compares to that type of sales?
Deleteseems cheap....
DeleteThat would not happen if Ticketmaster still had the best programmer that ever lived.
ReplyDeleteI audibly chuckled at this comment. RIP Terry.
DeleteI don't know the reference
Deletehttps://en.m.wikipedia.org/wiki/Terry_A._Davis
DeleteA prolific poster on Hacker News before his death. You'll need showdead enabled to see most of his comments.
Oh, I didn’t know he worked there!
DeleteI recently managed to get Temple OS to run in a VM for the first time. It’s quite something!
direct link to his HN account: https://news.ycombinator.com/user?id=TerryADavis
DeleteShould be unshadowed for posterity
DeleteI was aware of the Terry Davis/Temple OS story.
DeleteI didn't know he worked at Ticketmaster. Thanks.
https://en.wikipedia.org/wiki/Terry_A._Davis
DeleteI’m shocked to learn Terry Davis is dead. RIP
templeos creator used to work there. had mental health issues, we saw the decline via social media. 4chan made him a meme. he became homeless and died
DeleteDo you really think it's nice to mock a person with schizophrenia?
DeleteI think you're the one implicitly claiming that Terry wasn't among the greatest.
DeleteI believe he is, and I took OP's comment charitably.
Terry was an incredible programmer. I don't think anyone would argue against that.
DeleteI saw it as mocking Ticketmaster.
DeleteOn one hand, yes, there's a certain amount of schadenfreude here, because I have on multiple occasions been more or less annoyed by Ticketmaster. On the other hand, because I've used them quite a lot (because for many events, what other choice is there?), I can't say I'm terribly happy that my personal information has been so thoroughly exposed via this hack. And I'm more than a bit frustrated that Ticketmaster/Live Nation have been so careless and sloppy with their security - and employee training and vetting - to allow this to happen.
ReplyDeleteI assume Ticketmaster are fighting fires at the moment, or it could be coincidence, as I logged in to change my [unique to Ticketmaster] password and the 2FA confirmation appears to be broken, as it gave the same code 3 times and wouldn't accept it, plus the emails to reset the password aren't going out (or are going out slowly).
ReplyDeleteHope you hashed, salted, peppered those passwords Ticketmaster. And I hope you were following PCI level 1 correctly otherwise if this is true then you're a bit fucked really aren't you.
They should have kept Terry. He would have been vigilant about the three letter agencies as well.
ReplyDelete> To its critics, it seems Ticketmaster may be experiencing some karma lately for years of being the bane of concertgoers' existence.
ReplyDeleteAh yes, karma, that legendary force which revenges itself upon evil businesses like Ticketmaster by checks notes exposing the personal and financial information of their unwilling customers.
This is not verified. Mashable pulled a dirty headline by writing on this based on speculation.
ReplyDeleteThe initial account that shared the sale had no reputation on the forums. But it was then reposted by one of the admins, and that is the only piece of credibility this story has.
Still miss the good ol' days of Mashable, versus the sad state it's in now. And, yes, I know I'm pining for a version of the site that has been dead and gone for a long time now.
Deletehttps://web.archive.org/web/20060110132428/http://www.mashable.com/
Guess they shoulda spent some of those ticket fees on a security team.
ReplyDeleteNew revenue Op, cha-ching:
DeleteSecurity Fee: $49 per ticket.
“Future credit monitoring fee”
DeleteIf there wasn’t one company responsible for all of concert ticketing in the US maybe there would be fewer victims.
ReplyDeleteUS Only: This is your regular data breach reminder to freeze your credit with all 3 credit bureaus, as well as with NCTUE. It's free to do, easy to lift when you need to, and helps prevent credit fraud (also known, incorrectly, as identity theft).
ReplyDelete> (also known, incorrectly, as identity theft)
DeleteYou might not like the term and how it might seem to shift blame, but it's the correct term.
https://www.law.cornell.edu/uscode/text/18/1028A
Aside from legal definitions, it's definitely a broadly used term in the public arena as well. According to Wikipedia, it's been used this way since 1964.
> You might not like the term and how it might seem to shift blame, but it's the correct term.
DeleteIt absolutely shifts blame, and the term came from the banking sector themselves with the purpose of doing so.
I could not care less what the "correct" term is. It is credit fraud, full stop. No one has stolen any one's identity.
Obligatory Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E
Why should I have to jump through all these hoops just because some (most?) banks can’t be bothered to do proper KYC before lending money or extending credit?
DeleteNCTUE was new to me... I love that they're apparently gathering all this data to sell, but if you don't want your data to be sold, you have to snail mail them or call them...
DeleteCan’t wait for my 6 months of Free Credit Monitoring (tm)
ReplyDeleteNow let's take this opportunity and shut down this predatory website
ReplyDeleteI wonder if GDPR fines will get issued. If so hopefully the EU slaps on some processing fees and digital delivery fees and some admin fees and some notification fees on top of the fines.
ReplyDeleteDon't forget the fee payment processing fee.
DeleteThe $3 discount on their services I’ll get in several years from the class action suit will be sweet to never use.
ReplyDeleteThey’ll just raise their service fee to $4
DeleteThey’ll tack on a legal settlement fee that generates a profit.
DeleteI got a large settlement credit from SeatGeek last year, I got to go to a few games with it, so that was cool
DeleteWhat was the dispute?
DeleteIt was a class action settlement for having different prices on app versus browser (I think) so, the more you used the service the larger credit you got.
DeleteAll these fees and they couldn’t protect the most important thing.
ReplyDeleteThe friends we made along the way?
DeleteIt's about having the sense of pride and accomplishment
Deletenah i'm pretty sure they're keeping their money
DeleteI see a $15.38 class action settlement payment in my future
ReplyDeleteYou are wildly optimistic
DeleteMove that decimal over to the left by one spot, and you are correct
DeleteYou'll get a $5 coupon off select Ticketmaster events that aren't selling that expires in a month
DeleteWhy would you hack ticketmaster? No one who uses them has any money to steal after paying their crazy prices and fees
ReplyDeleteYa and why hack such an ethical company who does nothing but help society 💔
DeleteTicketmaster remains completely unharmed except in reputation, all the people buying from them are the ones who will actually suffer.
DeleteThe hackers didn't do anybody a favor here.
Just wait till they hack Draft Kings/Fan Duel, all negative accounts
DeleteIs that who charged Onlyfans to my Chase card? SMH I swear it was not me!!
ReplyDeleteDon't be a simp
DeleteEven bigger reason for the government to break those scumbags up
ReplyDeleteCouldn't have happened to a better company and I hope this is the beginning of the end for TM
ReplyDeleteBoys time to get our $5 class action lawsuit payouts! We'll be eating good in a year or two 😎😎
ReplyDeleteCant even get a big Mac (just the sandwich) for that anymore. 😕
DeleteCan't even pay one of the tacked on Ticketmaster fees with that
DeleteTotally coincidence this happens right when Ticketmaster is getting anti trusted.
ReplyDeleteI hope ticketmaster pays the $500k fee. I also hope that the amount jumps to $1.1m when they get to the checkout when fees are tacked on.
ReplyDeleteHaha I love this. Would be a great SNL skit
ReplyDeleteHackers should have just cancelled fees for the PR
ReplyDeleteMaybe put some of the exorbitant fees into security
ReplyDeleteTM: No
DeleteSick, just entered all my information in last week so I could get paid for tickets I sold
ReplyDelete500k?
ReplyDeleteIf they can hack ticketmaster they can hack any normal sized company worth hundreds of millions and demand million(s) in ransom depending on the company and the sensitivity of the data.
Companies these days always keep their data backed up at but its the risk of exposing the data thats valuable to the hackers.
These companies do get hacked, they just pay the ransom
DeleteThe Internet already has all my data. Lol. You're a decade too late, Shiny Hunters.
ReplyDeletepreach
ReplyDeleteTicketmaster will get fined and the cost will be passed into consumers
ReplyDeleteThis is why we need to hold leadership accountable for corporate bullshit. There needs to be actual incentive to do things legally and safely. Fines are meaningless to corporations.
DeleteIf only lawmakers weren't lobbied and influenced by the same corporate lobbyers
DeleteThe government should be holding this firms to higher security standards if they retain customer/employee data.
DeleteHell even workplaces should be held liable for these events. A place I worked at 7 years ago still had my info and they got hacked and it was potentially leaked. It's ridiculous.