Ticketfly ticketfly.com Ticketfly data breach: what happened and what to do
In May 2018, Ticketfly's website was defaced and taken offline. The leaked data held over 26 million unique email addresses with names, physical addresses and phone numbers. Ticketfly said card details weren't accessed.
View all 13,115 breaches- Breach date
- 31 May 2018
- Affected
- 26,151,608
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2018, the website for the ticket distribution service Ticketfly was defaced by an attacker and taken offline. Have I Been Pwned says the attacker allegedly asked for a ransom to share details of the vulnerability, got no reply, and then posted the breached data to a publicly accessible location.
Ticketfly said in a later update that it worked with outside forensic experts and that credit and debit card information was not accessed (Pollstar). The site came back online in June.
What was exposed
The data included over 26 million unique email addresses along with names, physical addresses and phone numbers. No passwords were in the publicly leaked data, but Ticketfly said hashed password values could have been accessed.
What it means for you
An email, name, home address and phone number is a ready-made profile for phishing, fake delivery notices and phone scams. Ticket buyers are an easy target for fake resale and refund messages. If you reused your Ticketfly password elsewhere, change it, in case hashes were taken.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Criminals use leaked names, addresses and phone numbers to write messages that look personal. Don't click links or open attachments in unexpected emails or texts, and go to a company's site directly instead.
- 2
Be wary of ticket and refund messages
Fake resale offers and refund requests are common after a ticketing breach. Buy and manage tickets only through the official site or app.
- 3
Change your password, and every place you reused it
Set a new, unique password on any site where you reused a Ticketfly password, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login wherever it's offered.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which known breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Ticketfly breach?
If you had a Ticketfly account in 2018, your email may be among the 26 million unique addresses. Search it on Have I Been Pwned.
What was exposed?
Email addresses, names, phone numbers and physical addresses.
Were card details taken?
Ticketfly said credit and debit card information was not accessed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
