Ticketmaster ticketmaster.com Ticketmaster data breach: what happened and what to do
In May 2024 Live Nation said unauthorized activity hit a third-party cloud database holding mostly Ticketmaster data. Names, contact details, order information and, for some customers, encrypted card details could be exposed. A seller claimed 560 million customers, which was not confirmed.
View all 13,115 breaches- Breach date
- 20 May 2024
- Made public
- 31 May 2024
- Data exposed
- Names, Email addresses, Phone numbers, Physical addresses, Credit cards
- Last updated
What happened
On May 20, 2024, Live Nation, the parent company of Ticketmaster, said it found unauthorized activity in a third-party cloud database that held mostly Ticketmaster data. It disclosed this in a filing with the US Securities and Exchange Commission around May 31. Live Nation said that by May 27 a criminal had offered the stolen data for sale on the dark web. It also said it did not expect the incident to have a material impact on its business or finances.
The filing did not name the cloud provider. A Ticketmaster spokesperson later told reporters it was Snowflake, a data storage service used by many large companies. Snowflake said the activity was part of a wider run of attacks that used customer login credentials stolen elsewhere, rather than a flaw in its own platform.
How many people
The number is the unsettled part. Reports at the time said the seller claimed to hold data on about 560 million Ticketmaster customers, in a 1.3 terabyte database. Some of the sample data was checked by journalists and researchers and looked genuine, but Live Nation did not confirm that figure. State breach filings only show the residents of a single state, so they don't give an overall count either. Treat 560 million as a claim, not a confirmed total.
What was exposed
Ticketmaster told affected customers that the data could include:
- Names
- Basic contact details such as email addresses, phone numbers and addresses
- Order and ticket purchase information
- For some customers, encrypted payment card numbers and expiration dates
Passwords were not among the data types reported.
What that lets criminals do
Contact details plus a record of what you bought are a good starting kit for phishing. A message that mentions the right event, venue or ticket order looks far more real than a generic "your account is locked" email. Expect fake refund notices, resale offers and "verify your order" texts, especially around big tours.
The card data was encrypted, which makes it much harder to use, and card numbers can be replaced. The contact details can't be, which is why the scam risk lasts longer than the card risk.
What Ticketmaster and Live Nation did
Live Nation's filing said it was investigating, working to contain the activity and contacting regulators and affected customers. It said the incident was not reasonably likely to have a material impact on its operations or finances.
Where Serus fits
The stolen data is out of anyone's hands now, so the useful work is catching what it leads to. Serus monitors breach databases and the dark web and alerts you if your email or phone number appears, and it removes your exposed data from the data brokers and people-search sites that scammers use to fill in the gaps about you.
What to do if you were in it
- 1
Treat ticket messages with suspicion
Expect fake refund, resale and 'verify your order' emails and texts that mention real events. Open Ticketmaster in the app or type the address yourself instead of tapping a link.
- 2
Check your cards
If you used a card with Ticketmaster, look through recent statements for charges you don't recognize. If Ticketmaster told you your card was affected, ask your bank for a new one.
- 3
Change your Ticketmaster password and turn on 2FA
Passwords weren't reported as exposed, but the attack on the cloud provider came through stolen login credentials. Use a unique password and a 2FA app.
- 4
Consider a credit freeze
Ticketmaster did not list Social Security numbers, so this isn't urgent. A free freeze at Equifax, Experian and TransUnion is still cheap protection if your details are circulating.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details show up and get alerted if they appear again.
Frequently asked
Was I affected by the Ticketmaster data breach?
Ticketmaster contacted customers it believed were affected. If you didn't hear anything, you can't rule it out, so watch for scam messages that mention tickets.
How many people were affected?
It isn't confirmed. A seller claimed data on about 560 million customers, but Live Nation hasn't confirmed a total.
What was exposed in the Ticketmaster breach?
Names, basic contact details, order information and, for some customers, encrypted card numbers and expiration dates.
Should I change my password?
It's a sensible precaution, especially if you reuse it. Passwords weren't reported as exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
