Ticketmaster's parent company, Live Nation, has confirmed “unauthorized activity” in its database following claims by hacking group ShinyHunters that they stole the personal data of 560 million customers.
The compromised data reportedly included names, addresses, phone numbers and partial credit card information of Ticketmaster users worldwide.
ShinyHunters, the group behind the breach, is demanding a ransom of $500,000 (£400,000) to prevent the data from being sold. Live Nation disclosed the incident in a filing with the U.S. Securities and Exchange Commission, which said that on May 27, “a criminal threat actor allegedly offered the company's user data for sale via the dark web.” The company is currently investigating the breach.
While the exact number of affected customers has not been confirmed by Live Nation, the breach was first revealed when hackers advertised the stolen data on Wednesday evening. Despite initial reluctance to confirm the breach to reporters or customers, Ticketmaster notified shareholders late Friday.
Both the Australian government and the FBI are involved in tackling the issue. An FBI spokesperson would not comment on the case.
In its SEC filing, Live Nation assured that it is working to “mitigate the risks to its customers” and is notifying users of the unauthorized access to their personal data. The company stated that the incident is not expected to have a material impact on its overall business operations or financial condition.
Ticketmaster, one of the world's largest online ticketing platforms, is facing one of the largest data breaches in history. The sensitivity of the data in the hands of cybercriminals remains unclear. This breach is part of a broader hacking campaign involving a cloud service provider called Snowflake, which has warned its customers of increased cyber threat activity.
In a related incident, Santander confirmed that data belonging to an estimated 30 million customers has been stolen and is being sold by the same hacking group. The bank clarified that UK customer data was not affected.
The hacking forum BreachForums, where the stolen data was advertised, is a notorious site on the dark web for trading stolen information. ShinyHunters has a history of high-profile data breaches, including the sale of data on 70 million AT&T customers and a breach affecting nearly 200,000 Pizza Hut customers in Australia.
The FBI previously shut down BreachForums in March 2023 and arrested its administrator, Conor Brian Fitzpatrick. However, the forum has since resurfaced.
If the scale of the Ticketmaster breach is confirmed, it could rank as one of the largest data breaches ever, both in terms of the number of people affected and the volume of data stolen. This isn't the first security issue for Ticketmaster, which was fined $10 million in 2020 for hacking into a competitor's system and suffered a cyberattack in November that disrupted ticket sales for Taylor Swift's Era tour.
To add to the woes, Live Nation is currently facing a lawsuit from US regulators who accuse the company of monopolistic practices in the live music industry, leading to higher ticket prices and poorer service for customers.
While the investigation continues, affected customers are advised to remain vigilant for signs of fraudulent activity and monitor communications from Ticketmaster and Live Nation for updates on the breach and protective measures being implemented.
