11 ms·

Ticketmaster breach affects more than half a billion users

223 points by RafelMri 2y ago

olliej 2y ago
Can’t wait for my 6 months of Free Credit Monitoring (tm)
- FireBeyond 2y ago
  "But you will have to provide a credit card to sign up for it, and after the 6 months you'll be automatically moved to our Platinum $59/mo monitoring plan".
  - olliej 2y ago
    and you agree to no liability if we leak your CC info
aszantu 2y ago
Damn, i missed the dip
throwmeaball 2y ago
That would not happen if Ticketmaster still had the best programmer that ever lived.
- anonfordays 2y ago
  I audibly chuckled at this comment. RIP Terry.
- paulddraper 2y ago
  I don't know the reference
  - dgellow 2y ago
    https://en.wikipedia.org/wiki/Terry_A._Davis https://en.wikipedia.org/wiki/Terry_A._Davis I’m shocked to learn Terry Davis is dead. RIP
  - dvngnt_ 2y ago
    templeos creator used to work there. had mental health issues, we saw the decline via social media. 4chan made him a meme. he became homeless and died
  - Eiriksmal 2y ago
    https://en.m.wikipedia.org/wiki/Terry_A._Davis https://en.m.wikipedia.org/wiki/Terry_A._Davis A prolific poster on Hacker News before his death. You'll need showdead enabled to see most of his comments.
    - nickthegreek 2y ago
      direct link to his HN account: https://news.ycombinator.com/user?id=TerryADavis https://news.ycombinator.com/user?id=TerryADavis
      - lagniappe 2y ago
        Should be unshadowed for posterity
    - lxgr 2y ago
      Oh, I didn’t know he worked there! I recently managed to get Temple OS to run in a VM for the first time. It’s quite something!
    - paulddraper 2y ago
      I was aware of the Terry Davis/Temple OS story. I didn't know he worked at Ticketmaster. Thanks.
- fortran77 2y ago
  Do you really think it's nice to mock a person with schizophrenia?
  - soulofmischief 2y ago
    I think you're the one implicitly claiming that Terry wasn't among the greatest. I believe he is, and I took OP's comment charitably.
  - pavel_lishin 2y ago
    I saw it as mocking Ticketmaster.
  - shepherdjerred 2y ago
    Terry was an incredible programmer. I don't think anyone would argue against that.
  - ferociouskite56 2y ago
    I'd never make fun of someone hallucinating. But the ineffective, discriminatory psychiatrists would.
namanyayg 2y ago
Now let's take this opportunity and shut down this predatory website
aresant 2y ago
Interesting this is marketed for $500k as a "One Time Sale" (1) I find the "honor amongst thieves" part so interesting in these breach stories (1) Troy Hunt, via an "X" user has a screenshot to the actual sale -> https://x.com/troyhunt/status/1795551650553491870 https://x.com/troyhunt/status/1795551650553491870
- dgellow 2y ago
  $500k for 1.3TB, any idea how that compares to that type of sales?
  - htrp 2y ago
    seems cheap....
- charles_f 2y ago
  If this is real, you'd hope for Ticketmaster to come in clean and purchase it back.
  - shiandow 2y ago
    Would be ironic if someone else bought it and sold it to Ticketmaster at a significant markup
    - charles_f 2y ago
      Although I doubt they would buy it back, their customers all hate them, they have the worst reputation, and they've never given any shits about that. So I don't think they'll do any of that anyhow.
      - floor2 2y ago
        > their customers all hate them, they have the worst reputation Maybe worth pointing out- that's a feature, not a bug. The value Ticketmaster provides is taking the anger from fans for high prices. The performers (and producers/labels/whatever) want to extract as much value from their fans as they can, and having Ticketmaster look like the greedy badperson prevents their fans from being mad at them.
epiccoleman 2y ago
> To its critics, it seems Ticketmaster may be experiencing some karma lately for years of being the bane of concertgoers' existence. Ah yes, karma, that legendary force which revenges itself upon evil businesses like Ticketmaster by checks notes exposing the personal and financial information of their unwilling customers.
s_dev 2y ago
I wonder if GDPR fines will get issued. If so hopefully the EU slaps on some processing fees and digital delivery fees and some admin fees and some notification fees on top of the fines.
- soulofmischief 2y ago
  Don't forget the fee payment processing fee.
JadoJodo 2y ago
I feel sad saying this: I don't think it's right, but I worry less and less about these as time goes on; Not because I don't think it sucks, but because my information has been in so many breaches up to this point that I'm not sure what value there is left in any data that might appear in subsequent breaches.
- ortusdux 2y ago
  There is a bit of a security through obscurity effect when a breach affects 5-10% of the population.
  - dingnuts 2y ago
    unless someone is specifically looking for you. imagine being a young woman with a stalker
    - stalked_why 2y ago
      Men too, even for absolutely no reason at all. In my case my partner (Abby) made a new friend (Brandy). Brandy called me a few times while we were coordinating social activities. Brandy’s soon-to-be ex-husband (Malicious Michael) saw the late-night phone calls on the phone bill records, looked up my phone number, saw that I was a man, assumed she started dating me, and became completely obsessed with me. Now I get about 30 texts and 12 emails from Mike every day, all of them very deranged and alarming. I have never met, interacted, talked with, responded to, or crossed paths with Mike. But suddenly I have to worry about how even these relatively benign leaks might impact his ability to find me or attempt to fuck up my life.
      - Nexxius 2y ago
        Reply to the texts with "dick pics"...but of horse or cow penis. Chances are pretty good he will block you or just stop soon after the first. For email...auto reply with links to https://en.wikipedia.org/wiki/Goatse.cx https://en.wikipedia.org/wiki/Goatse.cx or go for the the rabbit hole and toss out a random OnlyFans /Ashley Madison / Grinder page.
bartread 2y ago
On one hand, yes, there's a certain amount of schadenfreude here, because I have on multiple occasions been more or less annoyed by Ticketmaster. On the other hand, because I've used them quite a lot (because for many events, what other choice is there?), I can't say I'm terribly happy that my personal information has been so thoroughly exposed via this hack. And I'm more than a bit frustrated that Ticketmaster/Live Nation have been so careless and sloppy with their security - and employee training and vetting - to allow this to happen.
ivirshup 2y ago
Guess they shoulda spent some of those ticket fees on a security team.
- mixmastamyk 2y ago
  New revenue Op, cha-ching: Security Fee: $49 per ticket.
  - sokoloff 2y ago
    “Future credit monitoring fee”
skilled 2y ago
This is not verified. Mashable pulled a dirty headline by writing on this based on speculation. The initial account that shared the sale had no reputation on the forums. But it was then reposted by one of the admins, and that is the only piece of credibility this story has.
- strictnein 2y ago
  Still miss the good ol' days of Mashable, versus the sad state it's in now. And, yes, I know I'm pining for a version of the site that has been dead and gone for a long time now. https://web.archive.org/web/20060110132428/http://www.mashable.com/ https://web.archive.org/web/20060110132428/http://www.mashab...
adancalderon 2y ago
They should have kept Terry. He would have been vigilant about the three letter agencies as well.
Carrok 2y ago
US Only: This is your regular data breach reminder to freeze your credit with all 3 credit bureaus, as well as with NCTUE. It's free to do, easy to lift when you need to, and helps prevent credit fraud (also known, incorrectly, as identity theft).
- lxgr 2y ago
  Why should I have to jump through all these hoops just because some (most?) banks can’t be bothered to do proper KYC before lending money or extending credit?
- ldoughty 2y ago
  NCTUE was new to me... I love that they're apparently gathering all this data to sell, but if you don't want your data to be sold, you have to snail mail them or call them...
- criddell 2y ago
  > (also known, incorrectly, as identity theft) You might not like the term and how it might seem to shift blame, but it's the correct term. https://www.law.cornell.edu/uscode/text/18/1028A https://www.law.cornell.edu/uscode/text/18/1028A Aside from legal definitions, it's definitely a broadly used term in the public arena as well. According to Wikipedia, it's been used this way since 1964.
  - Carrok 2y ago
    > You might not like the term and how it might seem to shift blame, but it's the correct term. It absolutely shifts blame, and the term came from the banking sector themselves with the purpose of doing so. I could not care less what the "correct" term is. It is credit fraud, full stop. No one has stolen any one's identity. Obligatory Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
    - criddell 2y ago
      > the term came from the banking sector themselves with the purpose of doing so As far as I can see after a bit of research, that doesn't seem to be the case. Do you recall where you first heard that idea? > No one has stolen any one's identity. Nobody thinks that a victim of identity theft is left with no identity. It's figurative language just like your computer firewall isn't there to keep the flames back.
throwaway5959 2y ago
If there wasn’t one company responsible for all of concert ticketing in the US maybe there would be fewer victims.
leejo 2y ago
I assume Ticketmaster are fighting fires at the moment, or it could be coincidence, as I logged in to change my [unique to Ticketmaster] password and the 2FA confirmation appears to be broken, as it gave the same code 3 times and wouldn't accept it, plus the emails to reset the password aren't going out (or are going out slowly). Hope you hashed, salted, peppered those passwords Ticketmaster. And I hope you were following PCI level 1 correctly otherwise if this is true then you're a bit fucked really aren't you.
skilled 2y ago
vx-underground on Twitter, > Based on data provided to us by the Threat Group responsible for the compromise, we can assert with a high degree of confidence the data is legitimate. Date ranges in the database appear to go as far back as 2011. However, some dates show information from the mid-2000's. > NOTE: The data provided to us, even as a 'sample', was absurdly large and made it difficult to review in depth. We are unable to verify the authenticity of financial information. Briefly skimming the PII present in the dump, it appears authentic. https://x.com/vxunderground/status/1796063116574314642 https://x.com/vxunderground/status/1796063116574314642 --- No official confirmation yet.
- toomuchtodo 2y ago
  SEC registrants are required to make a disclosure within 4 business days once a cybersecurity incident is deemed by the company to be material to a reasonable investor. https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
  - toomuchtodo 2y ago
    Filing submitted: https://news.ycombinator.com/item?id=40543408 https://news.ycombinator.com/item?id=40543408 https://stackdiary.com/ticketmaster-confirms-data-breach-with-a-sec-filing/ https://stackdiary.com/ticketmaster-confirms-data-breach-wit... Filing: https://www.sec.gov/Archives/edgar/data/1335258/000133525824000081/lyv-20240520.htm https://www.sec.gov/Archives/edgar/data/1335258/000133525824...
  - skilled 2y ago
    Yep! I am aware of this. All my previous comments on this specific story have been that this isn’t verified. Lots of major news sites pulled the trigger on the headline for nothing more than clicks. Some journalists say that Australian Home Affairs confirmed the breach… lol! They acknowledged the rumour, but that got spun as “verification”. Then again, maybe it’s lack of decent cybersecurity writers. I personally can’t stand this weaksauce writing with no fact checking and the nonchalant way of throwing companies under the bus.
AdmiralAsshat 2y ago
Boy I sure am glad that Ticketmaster refused to let me change my email address some months back when I was trying to clean up my profile and change the registered address from my_handle@gmail.com to my_handle+ticketmaster@gmail.com.
- throw0101d 2y ago
  > […] from my_handle@gmail.com to my_handle+ticketmaster@gmail.com. Webdevs of HN: how many of you make a point of allowing sub-addressing? * https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
  - oarsinsync 2y ago
    Why would you need to make a point of allowing sub-addressing? Surely it’s whether or not you make a point of disallowing it?
    - mrsilencedogood 2y ago
      I work at a place that just recently clamped down on this. We decided to normalize the emails so that we have a column in the db like "email" and then also "normalized_email" where normalized_email has a unique key on it too. This way, people can still make their email look like whatever they want, but they also only get 1 per email inbox. This was all because people were doing abuse more easily by churning lots of accounts while only needing 1 gmail address. Plugging this gap was a huge deal for us in reducing card testing problems.
      - mynameisvlad 2y ago
        We’ve done this for a long while too. You can use subaddressing, but you’re still limited to one account per “base email”. We also normalize dots and other methods of reusing an email account.
        2y ago
Bluestein 2y ago
PS. I just wanted to note, this is by the same outfit also responsible for the Santander break. (Both, apparently, due to a successful breach of an upstream storage provider).-
- NameError 2y ago
  That upstream provider being Snowflake, according to this article: https://www.hudsonrock.com/blog/snowflake-massive-breach-access-through-infostealer-infection https://www.hudsonrock.com/blog/snowflake-massive-breach-acc... (posted on HN here: https://news.ycombinator.com/item?id=40534868 https://news.ycombinator.com/item?id=40534868)
  - skilled 2y ago
    Thanks, upvoted!
  - Bluestein 2y ago
    Makes you wonder what other big outfits that are also Snowflake customers are affected.-
    - KoftaBob 2y ago
      Here's a list of their customers that they provide: https://www.snowflake.com/en/customers/all-customers/ https://www.snowflake.com/en/customers/all-customers/
      - araes 2y ago
        A few that might be dangerous. Pfizer, CMS Healthcare, Playstation (Sony), the LA school district, KFC, Freddie Mac (sideshow bob sound...), Capital One, AT&T, Yamaha, Vanderbilt, the Superior Court of California, Square, Siemens Health, Pacific Life Insurance, Ohio Worker's Compensation, Netgear, Micron, HP, Western Union, Warner Music Group, Siemens, Juniper Networks, Forbes, Comcast, City of Tacoma (very financially transparent, cloudy even), Autodesk, and Auburn University. Also, general informational map of those likely affected based on the Ticketmaster breach at least. https://developer.ticketmaster.com/assets/img/products-and-docs/map.jpg https://developer.ticketmaster.com/assets/img/products-and-d... Also: Okta also just got hit, and had 99% of user data stolen. Might be related. https://www.govexec.com/technology/2023/11/okta-breach-includes-theft-data-nearly-all-help-desk-users-including-some-feds/392352/ https://www.govexec.com/technology/2023/11/okta-breach-inclu... The Snowflake breach supposed affects up to 400 companies with a single credential exfiltration. The world wide web's starting to seem like more work than its worth... Also, lots of coverage. Just not front and center. (Reuters) https://www.reuters.com/technology/cybersecurity/live-nation-probing-ticketmaster-hack-amid-user-data-leak-concerns-2024-06-01/ https://www.reuters.com/technology/cybersecurity/live-nation... (Fox Business) https://www.foxbusiness.com/technology/hackers-claim-ticketmaster-data-breach-offer-info-560-million-customers-sale https://www.foxbusiness.com/technology/hackers-claim-ticketm... (Bloomberg) https://www.bloomberg.com/news/articles/2024-05-31/live-nation-says-hacker-is-trying-to-sell-user-data-on-dark-web?srnd=homepage-americas https://www.bloomberg.com/news/articles/2024-05-31/live-nati... (FT, Santander Portion) https://www.ft.com/content/cfeec015-60b2-4106-a279-4c74fbfd4d91 https://www.ft.com/content/cfeec015-60b2-4106-a279-4c74fbfd4... (Associated Press) https://apnews.com/article/ticketmaster-live-nation-data-breach-a756d803c686e07f3b73444b3ca42c74 https://apnews.com/article/ticketmaster-live-nation-data-bre... (BBC, Santander theft, claimed link to Snowflake) https://www.bbc.com/news/articles/c6ppv06e3n8o https://www.bbc.com/news/articles/c6ppv06e3n8o (CNN) https://www.cnn.com/2024/05/31/business/live-nation-ticketmaster-hack/index.html https://www.cnn.com/2024/05/31/business/live-nation-ticketma... (NBC) https://www.nbcnews.com/business/live-nation-probing-ticketmaster-hack-user-data-leak-concerns-rcna155017 https://www.nbcnews.com/business/live-nation-probing-ticketm... (CBS) https://www.cbsnews.com/video/what-to-know-about-alleged-ticketmaster-hack/ https://www.cbsnews.com/video/what-to-know-about-alleged-tic... (Bleeping Computer) https://www.bleepingcomputer.com/news/security/snowflake-account-hacks-linked-to-santander-ticketmaster-breaches/ https://www.bleepingcomputer.com/news/security/snowflake-acc... (Law360) https://www.law360.com/articles/1842317/live-nation-confirms-data-breach-days-after-consumer-suit https://www.law360.com/articles/1842317/live-nation-confirms... (Techcrunch, apparently did a secondary verification) https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/ https://techcrunch.com/2024/05/31/live-nation-confirms-ticke... (Security Week, note that new BreachForums and post may be honeypot) https://www.securityweek.com/hackers-boast-ticketmaster-breach-on-relaunched-breachforums/ https://www.securityweek.com/hackers-boast-ticketmaster-brea... (Spiceworks, BreachForums may have ShinyHunters as admins, and ShinyHunters are suspected of being middlemen or proxies) https://www.spiceworks.com/it-security/data-security/news/ticketmaster-breach-data-leaked/ https://www.spiceworks.com/it-security/data-security/news/ti... (Malware Bytes, screen cap of the post from BreachForums) https://www.malwarebytes.com/blog/news/2024/05/the-ticketmaster-breach-what-you-need-to-know https://www.malwarebytes.com/blog/news/2024/05/the-ticketmas...
overstay8930 2y ago
Surprised it didn't happen sooner, their infra guys are getting paid next to nothing and there's very little competence left on the team.
svdr 2y ago
The attackers are demanding only $500,000 as a ransom payment, that's cheap!
- crtasm 2y ago
  or extremely expensive, if the contents are not as described
- b800h 2y ago
  Yep, it's almost a Dr. Evil just-arrived-from-1967 sort of price. Bizarre.
renewiltord 2y ago
It wasn’t stolen. They still have a copy of it. More accurate to say “Data allegedly copied”. And it seems natural. Information wants to be free.
- ydnaclementine 2y ago
  Would you download a car?
- SketchySeaBeast 2y ago
  You say that, but I doubt you'd willingly post your full legal name/SSN/Address/DoB and credit card info onto hacker news right now.
- ragazzina 2y ago
  Theft means "the illegal act of taking another person's property without that person's freely-given consent". The fact that the victim can or cannot still access their property is not in the definition.
  - deleted 2y ago
    [deleted]
  - logicchains 2y ago
    Throughout most of human history "taking" meant that the thing is now yours and not theirs. If you had a book, I read it all and wrote my own copy, nobody would call that taking your book, it's copying your book. You can try to change the definition, but depriving something of ownership/use of something is qualitatively very different from making a copy of it, so it doesn't follow that the former should necessarily be treated the same as the latter.
    - dghlsakjg 2y ago
      Information has to be modelled differently. Where and how it is manifested is less relevant. If I told your secrets after we agreed not to share them, it would be a moral violation, even if you still had the copy of the journal that you recorded the secrets in.
spdustin 2y ago
I despise this company with a white hot fury that outshines J059-4351.
- dylan604 2y ago
  you nerd sniped me. I had to find out exactly how pissed off you were: https://www.space.com/brightest-quasar-ever-powered-black-hole-solar-mass-accretion-disk https://www.space.com/brightest-quasar-ever-powered-black-ho... That's pretty pissed off!
sneak 2y ago
Good thing you can use fake data with Ticketmaster purchases and aren’t forced to display matching government ID for access to venues. Oh, wait. There should be real, criminal penalties for leaking authentic, government-ID PII these days.
- cbsmith 2y ago
  Based on the reporting I've seen, I don't believe that information was part of the leak.
- Bluestein 2y ago
  Seconded.-
- xp84 2y ago
  Indeed. I can already predict the outcome here, regardless of their own culpability level, will be a fine less than the profit they bring in during a single week (or probably in 10 minutes if it's the week a Taylor Swift concert goes on sale). And all executive bonuses will still be paid.
JohnMakin 2y ago
> In 2020 it admitted it hacked into one of its competitors and agreed to pay a $10m fine. Lol, if an individual does this, you're going to go to jail. A company does this? Tiny fine. What a world we live in.
- sneak 2y ago
  Companies can’t “do” anything, they have no hands or brains. Human beings performed the hack in question. Prosecutorial discretion is real and dangerous. There are two sets of laws at work in the US, one for us, and a different one for them.
  - finack 2y ago
    Corporations really are amazing. They are, simultaneously, in a superposition of getting away with crimes because they don't exist, and providing goods and services and benefitting shareholders because they do. Remarkable.
  - ceejayoz 2y ago
    > Prosecutorial discretion is real and dangerous. A complete lack of it is also dangerous; that's what gets us zero-tolerance policies of suspending victims of school bullying.
- cbsmith 2y ago
  The particulars of the case matter. Describing it as "hacking" is more than a bit misleading.
  - JohnMakin 2y ago
    They were accessing a system via internal endpoints not released to the public. They were also using stolen credentials a former employee of songbird brought over to ticketmaster, and accessed devices using stolen credentials. If that isn't "hacking" then the word has lost all meaning. https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0 https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...
WalterBright 2y ago
As usual, organizations with giant databases do not compartmentalize the data.
wood_spirit 2y ago
Hopefully we get details on _how_ the snowflake employee was hacked. It makes us wonder how things could be tightened up and what can be applied to our own organisations. If the hackers got passwords then how come there wasn’t 2FA? Or did they get a Trojan onto an employee computer and surf onto it the corporate vpn? Or did they corrupt an employee? Or did the evil maid or something? And how long did they have access? Or another approach?
rasz 2y ago
> from OF, stolen data _of_ 560M Ticketmaster Users. Mitchell & Webb - Identity Theft all over again.
cush 2y ago
I continuously wonder how we keep building multi-billion dollar applications where both basic consumer protections aren’t in place and there’s almost no liability for the companies running them. A kid working at McDonalds requires a safe food handling certificate, and the store will be shut down if an inspector sees their fridge is too warm. Hopefully with E2E encryption, passkeys, and the like, the end of days is near for these massive data leaks, but without real consequences, these companies will never realize holding millions of people’s personal information is both a liability as well as an asset.
- finack 2y ago
  [flagged]
  - cush 2y ago
    I might have goofed the analogy. I was trying to illustrate that mature regulations and true liability mean that even McDonalds’ lowest level employees require standardized training. They know that a fridge must be ~40F. But the kid isn’t liable for leaving the fridge open. McDonald’s is. And because they’re liable, they have invested in sensors and alarms on every fridge
  - bigyikes 2y ago
    Very clever. Ticketmaster and McDonalds are both multi billion dollar corporations. How does capital factor into this? The person you’re replying to was highlighting the difference in food safety policies versus data safety policies.
ctippett 2y ago
Looks to be officially confirmed. I just received the following email from Ticketek Australia: > Dear Ticketek Customer, > We are writing to let you know that Ticketek has become aware of a cyber incident impacting Ticketek Australia account holder information, which is stored in a cloud-based platform, hosted by a reputable, global third party supplier. > We would like to reassure you that Ticketek has secure encryption methods in place for all passwords and your Ticketek account has not been compromised. In addition, we utilise secure encryption methods to handle credit card information and transactions are processed via a separate payment system which has not been impacted. Ticketek does not hold identity documents for its customers. > Since our third party supplier brought this to our attention, over the past few days we have worked diligently to put every resource into completing an investigation, so that we can communicate with you as quickly as possible. We wanted to notify you early to enable you to take steps to protect your information as a precautionary measure. > We have also notified the Australian Cyber Security Centre (ACSC) and we are liaising with the Office of the Australian Information Commissioner (OAIC) and the National Office of Cyber Security in relation to the incident. Full email: https://imgur.com/a/HOwR98C https://imgur.com/a/HOwR98C
flerchin 2y ago
Seems like a big deal, but pretty much the only data ticketmaster would have is a stored credit card, address, name, and purchase history. Right? Perhaps passwords are valuable because many folks reuse them across sites. I don't see appreciable movement in their stock at all.
- nikcub 2y ago
  > I don't see appreciable movement in their stock at all. That's because there is zero accountability for these breaches and even with a civil case you're looking at pennies per user as compensation. Better to do that than invest the 10s of millions required to correctly invest in good security practice and hygiene. This is the classic fight club scenario: "Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."

223 points by RafelMri 2y ago

olliej 2y ago

Can’t wait for my 6 months of Free Credit Monitoring (tm)

FireBeyond 2y ago
"But you will have to provide a credit card to sign up for it, and after the 6 months you'll be automatically moved to our Platinum $59/mo monitoring plan".
- olliej 2y ago
  and you agree to no liability if we leak your CC info

aszantu 2y ago

Damn, i missed the dip

throwmeaball 2y ago

That would not happen if Ticketmaster still had the best programmer that ever lived.

anonfordays 2y ago
I audibly chuckled at this comment. RIP Terry.
paulddraper 2y ago
I don't know the reference
- dgellow 2y ago
  https://en.wikipedia.org/wiki/Terry_A._Davis https://en.wikipedia.org/wiki/Terry_A._Davis I’m shocked to learn Terry Davis is dead. RIP
- dvngnt_ 2y ago
  templeos creator used to work there. had mental health issues, we saw the decline via social media. 4chan made him a meme. he became homeless and died
- Eiriksmal 2y ago
  https://en.m.wikipedia.org/wiki/Terry_A._Davis https://en.m.wikipedia.org/wiki/Terry_A._Davis A prolific poster on Hacker News before his death. You'll need showdead enabled to see most of his comments.
  - nickthegreek 2y ago
    direct link to his HN account: https://news.ycombinator.com/user?id=TerryADavis https://news.ycombinator.com/user?id=TerryADavis
    - lagniappe 2y ago
      Should be unshadowed for posterity
  - lxgr 2y ago
    Oh, I didn’t know he worked there! I recently managed to get Temple OS to run in a VM for the first time. It’s quite something!
  - paulddraper 2y ago
    I was aware of the Terry Davis/Temple OS story. I didn't know he worked at Ticketmaster. Thanks.
fortran77 2y ago
Do you really think it's nice to mock a person with schizophrenia?
- soulofmischief 2y ago
  I think you're the one implicitly claiming that Terry wasn't among the greatest. I believe he is, and I took OP's comment charitably.
- pavel_lishin 2y ago
  I saw it as mocking Ticketmaster.
- shepherdjerred 2y ago
  Terry was an incredible programmer. I don't think anyone would argue against that.
- ferociouskite56 2y ago
  I'd never make fun of someone hallucinating. But the ineffective, discriminatory psychiatrists would.

namanyayg 2y ago

Now let's take this opportunity and shut down this predatory website

aresant 2y ago

Interesting this is marketed for $500k as a "One Time Sale" (1) I find the "honor amongst thieves" part so interesting in these breach stories (1) Troy Hunt, via an "X" user has a screenshot to the actual sale -> https://x.com/troyhunt/status/1795551650553491870 https://x.com/troyhunt/status/1795551650553491870

dgellow 2y ago
$500k for 1.3TB, any idea how that compares to that type of sales?
- htrp 2y ago
  seems cheap....
charles_f 2y ago
If this is real, you'd hope for Ticketmaster to come in clean and purchase it back.
- shiandow 2y ago
  Would be ironic if someone else bought it and sold it to Ticketmaster at a significant markup
  - charles_f 2y ago
    Although I doubt they would buy it back, their customers all hate them, they have the worst reputation, and they've never given any shits about that. So I don't think they'll do any of that anyhow.
    - floor2 2y ago
      > their customers all hate them, they have the worst reputation Maybe worth pointing out- that's a feature, not a bug. The value Ticketmaster provides is taking the anger from fans for high prices. The performers (and producers/labels/whatever) want to extract as much value from their fans as they can, and having Ticketmaster look like the greedy badperson prevents their fans from being mad at them.

epiccoleman 2y ago

> To its critics, it seems Ticketmaster may be experiencing some karma lately for years of being the bane of concertgoers' existence. Ah yes, karma, that legendary force which revenges itself upon evil businesses like Ticketmaster by checks notes exposing the personal and financial information of their unwilling customers.

s_dev 2y ago

I wonder if GDPR fines will get issued. If so hopefully the EU slaps on some processing fees and digital delivery fees and some admin fees and some notification fees on top of the fines.

soulofmischief 2y ago
Don't forget the fee payment processing fee.

JadoJodo 2y ago

I feel sad saying this: I don't think it's right, but I worry less and less about these as time goes on; Not because I don't think it sucks, but because my information has been in so many breaches up to this point that I'm not sure what value there is left in any data that might appear in subsequent breaches.

ortusdux 2y ago
There is a bit of a security through obscurity effect when a breach affects 5-10% of the population.
- dingnuts 2y ago
  unless someone is specifically looking for you. imagine being a young woman with a stalker
  - stalked_why 2y ago
    Men too, even for absolutely no reason at all. In my case my partner (Abby) made a new friend (Brandy). Brandy called me a few times while we were coordinating social activities. Brandy’s soon-to-be ex-husband (Malicious Michael) saw the late-night phone calls on the phone bill records, looked up my phone number, saw that I was a man, assumed she started dating me, and became completely obsessed with me. Now I get about 30 texts and 12 emails from Mike every day, all of them very deranged and alarming. I have never met, interacted, talked with, responded to, or crossed paths with Mike. But suddenly I have to worry about how even these relatively benign leaks might impact his ability to find me or attempt to fuck up my life.
    - Nexxius 2y ago
      Reply to the texts with "dick pics"...but of horse or cow penis. Chances are pretty good he will block you or just stop soon after the first. For email...auto reply with links to https://en.wikipedia.org/wiki/Goatse.cx https://en.wikipedia.org/wiki/Goatse.cx or go for the the rabbit hole and toss out a random OnlyFans /Ashley Madison / Grinder page.

bartread 2y ago

On one hand, yes, there's a certain amount of schadenfreude here, because I have on multiple occasions been more or less annoyed by Ticketmaster. On the other hand, because I've used them quite a lot (because for many events, what other choice is there?), I can't say I'm terribly happy that my personal information has been so thoroughly exposed via this hack. And I'm more than a bit frustrated that Ticketmaster/Live Nation have been so careless and sloppy with their security - and employee training and vetting - to allow this to happen.

ivirshup 2y ago

Guess they shoulda spent some of those ticket fees on a security team.

mixmastamyk 2y ago
New revenue Op, cha-ching: Security Fee: $49 per ticket.
- sokoloff 2y ago
  “Future credit monitoring fee”

skilled 2y ago

This is not verified. Mashable pulled a dirty headline by writing on this based on speculation. The initial account that shared the sale had no reputation on the forums. But it was then reposted by one of the admins, and that is the only piece of credibility this story has.

strictnein 2y ago
Still miss the good ol' days of Mashable, versus the sad state it's in now. And, yes, I know I'm pining for a version of the site that has been dead and gone for a long time now. https://web.archive.org/web/20060110132428/http://www.mashable.com/ https://web.archive.org/web/20060110132428/http://www.mashab...

adancalderon 2y ago

They should have kept Terry. He would have been vigilant about the three letter agencies as well.

Carrok 2y ago

US Only: This is your regular data breach reminder to freeze your credit with all 3 credit bureaus, as well as with NCTUE. It's free to do, easy to lift when you need to, and helps prevent credit fraud (also known, incorrectly, as identity theft).

lxgr 2y ago
Why should I have to jump through all these hoops just because some (most?) banks can’t be bothered to do proper KYC before lending money or extending credit?
ldoughty 2y ago
NCTUE was new to me... I love that they're apparently gathering all this data to sell, but if you don't want your data to be sold, you have to snail mail them or call them...
criddell 2y ago
> (also known, incorrectly, as identity theft) You might not like the term and how it might seem to shift blame, but it's the correct term. https://www.law.cornell.edu/uscode/text/18/1028A https://www.law.cornell.edu/uscode/text/18/1028A Aside from legal definitions, it's definitely a broadly used term in the public arena as well. According to Wikipedia, it's been used this way since 1964.
- Carrok 2y ago
  > You might not like the term and how it might seem to shift blame, but it's the correct term. It absolutely shifts blame, and the term came from the banking sector themselves with the purpose of doing so. I could not care less what the "correct" term is. It is credit fraud, full stop. No one has stolen any one's identity. Obligatory Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
  - criddell 2y ago
    > the term came from the banking sector themselves with the purpose of doing so As far as I can see after a bit of research, that doesn't seem to be the case. Do you recall where you first heard that idea? > No one has stolen any one's identity. Nobody thinks that a victim of identity theft is left with no identity. It's figurative language just like your computer firewall isn't there to keep the flames back.

throwaway5959 2y ago

If there wasn’t one company responsible for all of concert ticketing in the US maybe there would be fewer victims.

leejo 2y ago

I assume Ticketmaster are fighting fires at the moment, or it could be coincidence, as I logged in to change my [unique to Ticketmaster] password and the 2FA confirmation appears to be broken, as it gave the same code 3 times and wouldn't accept it, plus the emails to reset the password aren't going out (or are going out slowly). Hope you hashed, salted, peppered those passwords Ticketmaster. And I hope you were following PCI level 1 correctly otherwise if this is true then you're a bit fucked really aren't you.

skilled 2y ago

vx-underground on Twitter, > Based on data provided to us by the Threat Group responsible for the compromise, we can assert with a high degree of confidence the data is legitimate. Date ranges in the database appear to go as far back as 2011. However, some dates show information from the mid-2000's. > NOTE: The data provided to us, even as a 'sample', was absurdly large and made it difficult to review in depth. We are unable to verify the authenticity of financial information. Briefly skimming the PII present in the dump, it appears authentic. https://x.com/vxunderground/status/1796063116574314642 https://x.com/vxunderground/status/1796063116574314642 --- No official confirmation yet.

toomuchtodo 2y ago
SEC registrants are required to make a disclosure within 4 business days once a cybersecurity incident is deemed by the company to be material to a reasonable investor. https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
- toomuchtodo 2y ago
  Filing submitted: https://news.ycombinator.com/item?id=40543408 https://news.ycombinator.com/item?id=40543408 https://stackdiary.com/ticketmaster-confirms-data-breach-with-a-sec-filing/ https://stackdiary.com/ticketmaster-confirms-data-breach-wit... Filing: https://www.sec.gov/Archives/edgar/data/1335258/000133525824000081/lyv-20240520.htm https://www.sec.gov/Archives/edgar/data/1335258/000133525824...
- skilled 2y ago
  Yep! I am aware of this. All my previous comments on this specific story have been that this isn’t verified. Lots of major news sites pulled the trigger on the headline for nothing more than clicks. Some journalists say that Australian Home Affairs confirmed the breach… lol! They acknowledged the rumour, but that got spun as “verification”. Then again, maybe it’s lack of decent cybersecurity writers. I personally can’t stand this weaksauce writing with no fact checking and the nonchalant way of throwing companies under the bus.

AdmiralAsshat 2y ago

Boy I sure am glad that Ticketmaster refused to let me change my email address some months back when I was trying to clean up my profile and change the registered address from my_handle@gmail.com to my_handle+ticketmaster@gmail.com.

throw0101d 2y ago
> […] from my_handle@gmail.com to my_handle+ticketmaster@gmail.com. Webdevs of HN: how many of you make a point of allowing sub-addressing? * https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
- oarsinsync 2y ago
  Why would you need to make a point of allowing sub-addressing? Surely it’s whether or not you make a point of disallowing it?
  - mrsilencedogood 2y ago
    I work at a place that just recently clamped down on this. We decided to normalize the emails so that we have a column in the db like "email" and then also "normalized_email" where normalized_email has a unique key on it too. This way, people can still make their email look like whatever they want, but they also only get 1 per email inbox. This was all because people were doing abuse more easily by churning lots of accounts while only needing 1 gmail address. Plugging this gap was a huge deal for us in reducing card testing problems.
    - mynameisvlad 2y ago
      We’ve done this for a long while too. You can use subaddressing, but you’re still limited to one account per “base email”. We also normalize dots and other methods of reusing an email account.
      - 2y ago

Bluestein 2y ago

PS. I just wanted to note, this is by the same outfit also responsible for the Santander break. (Both, apparently, due to a successful breach of an upstream storage provider).-

NameError 2y ago
That upstream provider being Snowflake, according to this article: https://www.hudsonrock.com/blog/snowflake-massive-breach-access-through-infostealer-infection https://www.hudsonrock.com/blog/snowflake-massive-breach-acc... (posted on HN here: https://news.ycombinator.com/item?id=40534868 https://news.ycombinator.com/item?id=40534868)
- skilled 2y ago
  Thanks, upvoted!
- Bluestein 2y ago
  Makes you wonder what other big outfits that are also Snowflake customers are affected.-
  - KoftaBob 2y ago
    Here's a list of their customers that they provide: https://www.snowflake.com/en/customers/all-customers/ https://www.snowflake.com/en/customers/all-customers/
    - araes 2y ago
      A few that might be dangerous. Pfizer, CMS Healthcare, Playstation (Sony), the LA school district, KFC, Freddie Mac (sideshow bob sound...), Capital One, AT&T, Yamaha, Vanderbilt, the Superior Court of California, Square, Siemens Health, Pacific Life Insurance, Ohio Worker's Compensation, Netgear, Micron, HP, Western Union, Warner Music Group, Siemens, Juniper Networks, Forbes, Comcast, City of Tacoma (very financially transparent, cloudy even), Autodesk, and Auburn University. Also, general informational map of those likely affected based on the Ticketmaster breach at least. https://developer.ticketmaster.com/assets/img/products-and-docs/map.jpg https://developer.ticketmaster.com/assets/img/products-and-d... Also: Okta also just got hit, and had 99% of user data stolen. Might be related. https://www.govexec.com/technology/2023/11/okta-breach-includes-theft-data-nearly-all-help-desk-users-including-some-feds/392352/ https://www.govexec.com/technology/2023/11/okta-breach-inclu... The Snowflake breach supposed affects up to 400 companies with a single credential exfiltration. The world wide web's starting to seem like more work than its worth... Also, lots of coverage. Just not front and center. (Reuters) https://www.reuters.com/technology/cybersecurity/live-nation-probing-ticketmaster-hack-amid-user-data-leak-concerns-2024-06-01/ https://www.reuters.com/technology/cybersecurity/live-nation... (Fox Business) https://www.foxbusiness.com/technology/hackers-claim-ticketmaster-data-breach-offer-info-560-million-customers-sale https://www.foxbusiness.com/technology/hackers-claim-ticketm... (Bloomberg) https://www.bloomberg.com/news/articles/2024-05-31/live-nation-says-hacker-is-trying-to-sell-user-data-on-dark-web?srnd=homepage-americas https://www.bloomberg.com/news/articles/2024-05-31/live-nati... (FT, Santander Portion) https://www.ft.com/content/cfeec015-60b2-4106-a279-4c74fbfd4d91 https://www.ft.com/content/cfeec015-60b2-4106-a279-4c74fbfd4... (Associated Press) https://apnews.com/article/ticketmaster-live-nation-data-breach-a756d803c686e07f3b73444b3ca42c74 https://apnews.com/article/ticketmaster-live-nation-data-bre... (BBC, Santander theft, claimed link to Snowflake) https://www.bbc.com/news/articles/c6ppv06e3n8o https://www.bbc.com/news/articles/c6ppv06e3n8o (CNN) https://www.cnn.com/2024/05/31/business/live-nation-ticketmaster-hack/index.html https://www.cnn.com/2024/05/31/business/live-nation-ticketma... (NBC) https://www.nbcnews.com/business/live-nation-probing-ticketmaster-hack-user-data-leak-concerns-rcna155017 https://www.nbcnews.com/business/live-nation-probing-ticketm... (CBS) https://www.cbsnews.com/video/what-to-know-about-alleged-ticketmaster-hack/ https://www.cbsnews.com/video/what-to-know-about-alleged-tic... (Bleeping Computer) https://www.bleepingcomputer.com/news/security/snowflake-account-hacks-linked-to-santander-ticketmaster-breaches/ https://www.bleepingcomputer.com/news/security/snowflake-acc... (Law360) https://www.law360.com/articles/1842317/live-nation-confirms-data-breach-days-after-consumer-suit https://www.law360.com/articles/1842317/live-nation-confirms... (Techcrunch, apparently did a secondary verification) https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/ https://techcrunch.com/2024/05/31/live-nation-confirms-ticke... (Security Week, note that new BreachForums and post may be honeypot) https://www.securityweek.com/hackers-boast-ticketmaster-breach-on-relaunched-breachforums/ https://www.securityweek.com/hackers-boast-ticketmaster-brea... (Spiceworks, BreachForums may have ShinyHunters as admins, and ShinyHunters are suspected of being middlemen or proxies) https://www.spiceworks.com/it-security/data-security/news/ticketmaster-breach-data-leaked/ https://www.spiceworks.com/it-security/data-security/news/ti... (Malware Bytes, screen cap of the post from BreachForums) https://www.malwarebytes.com/blog/news/2024/05/the-ticketmaster-breach-what-you-need-to-know https://www.malwarebytes.com/blog/news/2024/05/the-ticketmas...

overstay8930 2y ago

Surprised it didn't happen sooner, their infra guys are getting paid next to nothing and there's very little competence left on the team.

svdr 2y ago

The attackers are demanding only $500,000 as a ransom payment, that's cheap!

crtasm 2y ago
or extremely expensive, if the contents are not as described
b800h 2y ago
Yep, it's almost a Dr. Evil just-arrived-from-1967 sort of price. Bizarre.

renewiltord 2y ago

It wasn’t stolen. They still have a copy of it. More accurate to say “Data allegedly copied”. And it seems natural. Information wants to be free.

ydnaclementine 2y ago
Would you download a car?
SketchySeaBeast 2y ago
You say that, but I doubt you'd willingly post your full legal name/SSN/Address/DoB and credit card info onto hacker news right now.
ragazzina 2y ago
Theft means "the illegal act of taking another person's property without that person's freely-given consent". The fact that the victim can or cannot still access their property is not in the definition.
- deleted 2y ago
  [deleted]
- logicchains 2y ago
  Throughout most of human history "taking" meant that the thing is now yours and not theirs. If you had a book, I read it all and wrote my own copy, nobody would call that taking your book, it's copying your book. You can try to change the definition, but depriving something of ownership/use of something is qualitatively very different from making a copy of it, so it doesn't follow that the former should necessarily be treated the same as the latter.
  - dghlsakjg 2y ago
    Information has to be modelled differently. Where and how it is manifested is less relevant. If I told your secrets after we agreed not to share them, it would be a moral violation, even if you still had the copy of the journal that you recorded the secrets in.

spdustin 2y ago

I despise this company with a white hot fury that outshines J059-4351.

dylan604 2y ago
you nerd sniped me. I had to find out exactly how pissed off you were: https://www.space.com/brightest-quasar-ever-powered-black-hole-solar-mass-accretion-disk https://www.space.com/brightest-quasar-ever-powered-black-ho... That's pretty pissed off!

sneak 2y ago

Good thing you can use fake data with Ticketmaster purchases and aren’t forced to display matching government ID for access to venues. Oh, wait. There should be real, criminal penalties for leaking authentic, government-ID PII these days.

cbsmith 2y ago
Based on the reporting I've seen, I don't believe that information was part of the leak.
Bluestein 2y ago
Seconded.-
xp84 2y ago
Indeed. I can already predict the outcome here, regardless of their own culpability level, will be a fine less than the profit they bring in during a single week (or probably in 10 minutes if it's the week a Taylor Swift concert goes on sale). And all executive bonuses will still be paid.

JohnMakin 2y ago

> In 2020 it admitted it hacked into one of its competitors and agreed to pay a $10m fine. Lol, if an individual does this, you're going to go to jail. A company does this? Tiny fine. What a world we live in.

sneak 2y ago
Companies can’t “do” anything, they have no hands or brains. Human beings performed the hack in question. Prosecutorial discretion is real and dangerous. There are two sets of laws at work in the US, one for us, and a different one for them.
- finack 2y ago
  Corporations really are amazing. They are, simultaneously, in a superposition of getting away with crimes because they don't exist, and providing goods and services and benefitting shareholders because they do. Remarkable.
- ceejayoz 2y ago
  > Prosecutorial discretion is real and dangerous. A complete lack of it is also dangerous; that's what gets us zero-tolerance policies of suspending victims of school bullying.
cbsmith 2y ago
The particulars of the case matter. Describing it as "hacking" is more than a bit misleading.
- JohnMakin 2y ago
  They were accessing a system via internal endpoints not released to the public. They were also using stolen credentials a former employee of songbird brought over to ticketmaster, and accessed devices using stolen credentials. If that isn't "hacking" then the word has lost all meaning. https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0 https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...

WalterBright 2y ago

As usual, organizations with giant databases do not compartmentalize the data.

wood_spirit 2y ago

Hopefully we get details on _how_ the snowflake employee was hacked. It makes us wonder how things could be tightened up and what can be applied to our own organisations. If the hackers got passwords then how come there wasn’t 2FA? Or did they get a Trojan onto an employee computer and surf onto it the corporate vpn? Or did they corrupt an employee? Or did the evil maid or something? And how long did they have access? Or another approach?

rasz 2y ago

> from OF, stolen data _of_ 560M Ticketmaster Users. Mitchell & Webb - Identity Theft all over again.

cush 2y ago

I continuously wonder how we keep building multi-billion dollar applications where both basic consumer protections aren’t in place and there’s almost no liability for the companies running them. A kid working at McDonalds requires a safe food handling certificate, and the store will be shut down if an inspector sees their fridge is too warm. Hopefully with E2E encryption, passkeys, and the like, the end of days is near for these massive data leaks, but without real consequences, these companies will never realize holding millions of people’s personal information is both a liability as well as an asset.

finack 2y ago
[flagged]
- cush 2y ago
  I might have goofed the analogy. I was trying to illustrate that mature regulations and true liability mean that even McDonalds’ lowest level employees require standardized training. They know that a fridge must be ~40F. But the kid isn’t liable for leaving the fridge open. McDonald’s is. And because they’re liable, they have invested in sensors and alarms on every fridge
- bigyikes 2y ago
  Very clever. Ticketmaster and McDonalds are both multi billion dollar corporations. How does capital factor into this? The person you’re replying to was highlighting the difference in food safety policies versus data safety policies.

ctippett 2y ago

Looks to be officially confirmed. I just received the following email from Ticketek Australia: > Dear Ticketek Customer, > We are writing to let you know that Ticketek has become aware of a cyber incident impacting Ticketek Australia account holder information, which is stored in a cloud-based platform, hosted by a reputable, global third party supplier. > We would like to reassure you that Ticketek has secure encryption methods in place for all passwords and your Ticketek account has not been compromised. In addition, we utilise secure encryption methods to handle credit card information and transactions are processed via a separate payment system which has not been impacted. Ticketek does not hold identity documents for its customers. > Since our third party supplier brought this to our attention, over the past few days we have worked diligently to put every resource into completing an investigation, so that we can communicate with you as quickly as possible. We wanted to notify you early to enable you to take steps to protect your information as a precautionary measure. > We have also notified the Australian Cyber Security Centre (ACSC) and we are liaising with the Office of the Australian Information Commissioner (OAIC) and the National Office of Cyber Security in relation to the incident. Full email: https://imgur.com/a/HOwR98C https://imgur.com/a/HOwR98C

flerchin 2y ago

Seems like a big deal, but pretty much the only data ticketmaster would have is a stored credit card, address, name, and purchase history. Right? Perhaps passwords are valuable because many folks reuse them across sites. I don't see appreciable movement in their stock at all.

nikcub 2y ago
> I don't see appreciable movement in their stock at all. That's because there is zero accountability for these breaches and even with a civil case you're looking at pennies per user as compensation. Better to do that than invest the 10s of millions required to correctly invest in good security practice and hygiene. This is the classic fight club scenario: "Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."