12 ms·
Ticketmaster confirms data breach with a SEC filing
- ggm 2y agoAnd in Australia ticketek who has also filed an Australian cyber crime report. So far only name DOB and address.
- timothyduong 2y agoYou’d think for all the additional booking fees that they’re known for charging that they’d invest a little more into security of their infrastructure both internally and externally…
- sa-code 2y agoNope those fees might as well be called "yachts for executives fee"
- portaouflop 2y agoWhy should they invest? Most likely nothing bad will happen to their bottom line or execs so no reason to invest in security. We decided that profits are more important than accountability.
- nine_zeros 2y agoThose yachts won't get bought themselves.
- deleted 2y ago[deleted]
- mholt 2y agoThey recently got sued for being a monopoly. They have no incentive to do better. And unfortunately this probably won’t change anything. https://www.justice.gov/opa/pr/justice-department-sues-live-nation-ticketmaster-monopolizing-markets-across-live-concert https://www.justice.gov/opa/pr/justice-department-sues-live-...
- CaptainOfCoit 2y agoWho would think that? Extra earned resources never goes into improving security, why would it be different with Ticketmaster? Live Nation Entertainment / Live Nation, owner of Ticketmaster, is a public for-profit company, 100% of their focus will be on "more money now", and security doesn't contribute to that so of course they wouldn't focus on that.
- safety1st 2y agoOn the contrary, economists have known for some time [1] that this (investing in improvements to their product) is exactly what monopolies DON'T do well. And the DoJ is suing Ticketmaster for being an abusive monopoly as we speak, so..... [1] Actually, we've known this as far back as Adam Smith! He talked a fair bit of shit about monopolies in The Wealth of Nations. His "invisible hand," after all, was competition, which monopolies by definition don't have. Remember this every time someone talks shit about capitalism and points to corrupt and abusive American monopolies as evidence of why it's a failed system. America's government only really started leaning into its modern love for monopolies from the Reagan administration onward - in defiance of centuries of evidence that it was a bad idea.
- TeMPOraL 2y agoLike anything ever happened to any company that had a data breach. It's been shown time and again that it's a waste of money to care about this. In contrast, what is worth it is to do the minimum necessary to check the boxes on whatever certification the business is trying to get.
- nerdawson 2y agoTheir data was exposed by breaching a third party service. I'm not sure how investing more in security could have helped prevent this. You could argue that they shouldn't be housing this data with Snowflake but then you could say the same about a service like Amazon S3. At what point is a company able to rely on a third-party vs being expected to run it in-house?
- skeeter2020 2y agoYou're right, but nobody here cares about the details of data subprocessors and how a lot of nodes in the chain get impacted. It doesn't play well on the internet where short & pithy moral outrage is the level of discourse. It makes me sad that the initial reaction is gleeful & mean-spirited towards the targets, when if you've ever been involved in something like this you'd hope it would be empathy for what a lot of Snowflake and TM employees are working on this weekend, and anger towards the hackers. It's like people forget that because it's data and the targets are big companies these criminals aren't stealing from real people and making the world a worse place.
- mulmen 2y agoWhat data was leaked specifically? Were my payment credentials or bank account information leaked? How do customers know how to respond to this?
- deleted 2y ago[deleted]
- a012 2y ago> The hackers also shared a sample of the data, which includes hashed credit card numbers, the last four digits of credit cards, credit card expiration dates, and fraud details, as well as customer names, addresses, and emails. https://www.cyberdaily.au/security/10632-hackers-claim-ticketmaster-live-nation-data-breach-more-than-500m-compromised https://www.cyberdaily.au/security/10632-hackers-claim-ticke...
- saulrh 2y agoDoes anyone know what "fraud details" are? Is this just ("just", I say) the answers to security questions, or is this, like, your mother's maiden name and every address you've ever lived at and all the other stuff that would let anyone on earth open a bank account in your name?
- a012 2y agoI don’t know about the sample of leaked data, but I presume the fraud details is just a boolean value true or false which means the transaction was rated legitimate or not.
- deleted 2y ago[deleted]
- dimask 2y agoAnybody who is concerned and wants to learn what personal info of them ticketmaster holds and hence may have been compromised, and lives in a country where GDPR applies, they can send them a GDPR subject access request, eg something like [0]. Their emails in general look like privacy@ticketmaster.XXX where XXX the country code but probably also double check to make sure. [0] https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
- Tblue468 2y agoAs per the Ticketmaster website [1], there are also the following forms to request a copy of your data: - US: https://privacyportal.onetrust.com/webform/ba6f9c5b-dda5-43bd-bac4-4e06afccd928/a912475c-660e-40a7-b320-844ea439062a https://privacyportal.onetrust.com/webform/ba6f9c5b-dda5-43b... - Non-US countries: https://privacyportal.onetrust.com/webform/ba6f9c5b-dda5-43bd-bac4-4e06afccd928/c1dbc54f-8126-449d-8efc-94d7dec799a1 https://privacyportal.onetrust.com/webform/ba6f9c5b-dda5-43b... [1] https://privacy.ticketmaster.com/en/privacy-policy#your-choices-&-rights https://privacy.ticketmaster.com/en/privacy-policy#your-choi...
- Ylpertnodi 2y agoThe non-us sounds like a type of mediation. Gdpr requests have teeth.
- ChildOfChaos 2y agoNext week. Ticketmaster introduces new 'data protection fee' to all ticket purchases.
- ixaxaar 2y agoCool, rise of concert tourism? At least better than medical tourism ig.
- GrumpyNl 2y agoWill include AI to make it more safe.
- doctor_eval 2y agohttps://theshovel.com.au/2024/05/30/ticketmaster-hacker-demands-500k-ransom-plus-300k-processing-fee/ https://theshovel.com.au/2024/05/30/ticketmaster-hacker-dema... “Ticketmaster Hacker Demands $500K Ransom (Plus $300K Ransom Processing Fee, $220K Ransom Handling Fee)” Whole (joke) article is hilarious.
- deleted 2y ago[deleted]
- CaptainZapp 2y ago"As of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations. We continue to evaluate the risks and our remediation efforts are ongoing" Ah, All is well then. It has no material impact on your business. So, the 600'000'000 affected customers can kindly go and fuck themselves?
- anotheraccount9 2y agoSounds like the Equifax breach response ;) nothing to worry I guess
- nehal3m 2y agoThe PR is for shareholders, not the peasants.
- bobmcnamara 2y agoHey now, Ticketmaster will continue to fuck us too!
- chollida1 2y agoLook, I get just being blindly outraged at a hack and the hate that Ticketmaster seems to generate, but the company wrote this for the regulators and shareholders as much as anything. They have a legal duty to report hacks and report if it will have any affect on their business. And this is what they are doing here. Being outraged because a company does what they are legally obliged to do just makes you angry for no reason. They'll address the hack to customers no doubt, in a separate email/communication. At no point did they say the 600M people "can kindly go and fuck themselves" and contorting things to try and get there will just make you angry. If you want to blindly feel anger, you're welcome to, but the company did what they should here.
- fuzzfactor 2y ago>At no point did they say the 600M people "can kindly go and fuck themselves" With nary a word this was fully implied way before they even started collecting customer data. Companies can have this attitude regardlless of whether there is any data at all.
- mholt 2y agoTicketmaster has recently been sued by the DoJ for monopolizing: https://www.justice.gov/opa/pr/justice-department-sues-live-nation-ticketmaster-monopolizing-markets-across-live-concert https://www.justice.gov/opa/pr/justice-department-sues-live-... Too bad nothing will improve because of this.
- flawn 2y ago2 weeks ago, when attending a concert, i got forced TWICE back to back to reset my password when logging in. I jokingly called then that Ticketmaster got breached. Crazy to see this being actually true.
- wombat-man 2y agoI feel like I often have to login again with ticketmaster and I'm never sure of they can't figure out token refresh logic or if it's some kind of anti theft measure or what.
- portaouflop 2y agoIf you have refresh tokens in your first-party authentication flow you are already a good way down complexity lane - best to avoid IMO.
- HeckFeck 2y agoHappens all the time: I need the wretched app to go to a QR code-only concert. Would love to take up a stallman-esque stand against this, but the bands I love aren't getting any younger and neither am I. Need to show my digital ticket to the steward. Only to find the app has again signed out, spend ages fumbling with my phone and password manager to sign in, while standing in the rain outside of the venue. Not the seamless experience they promise!
- a012 2y agoIdk if you could take a screenshot of the QR code for offline use? I always do this when buying public transport tickets in Europe.
- pc86 2y agoThe last half-dozen concerts I've been to have some sort of live code or something where screenshots don't work. I haven't spent enough time trying to deduce if the code itself changes or if the scanner just reads animation over the code, but at least for the moment you do need the live app to get into most concerts if they're using the Ticketmaster or Live Nation apps.
- kmfrk 2y agoOne of the fun things about these messes is that sometimes you think you're unaffected, but then it turns out the company bought one of the companies you actually did sign up with, and all of a sudden you're a part of a database you never signed up for. Had that happen a few times with my +company@gmail filters that went on to reveal the trail of acquisition breadcrumbs.
- baxtr 2y ago> Researchers are also warning that it’s part of a larger ongoing hack involving a cloud service provider called Snowflake which is used by many large firms to store data in the cloud. Now that’s interesting. Anyone know how they’re related?
- dddddaviddddd 2y agohttps://news.ycombinator.com/item?id=40534868 https://news.ycombinator.com/item?id=40534868
- toofy 2y agoThere was a decent sized discussion here yesterday about the larger hack [0] The original article was pulled, strangely with no explanation as to why. and to make it even more confusing, Snowflake’s press release is pretty heavy with corporate speak making it difficult to tell if they’re outright denying it happened or if they’re dangling keys trying to buy themselves time. it’s worth going to the discussion. [0] https://news.ycombinator.com/item?id=40534868 https://news.ycombinator.com/item?id=40534868
- sys_64738 2y agoIf somebody becomes a victim of this Ticketmaster fraud then the company should be fully liable. We really need an event such as this to bankrupt a company and for all the C-level suits to be made financially bankrupt too. Let's use the like of Ticketmaster fraud as a starting point to make these companies prevent fraud in the first place, instead they pass the buck to those customers defrauded.
- skeeter2020 2y agoWho should "go bankrupt" in this case? Ticketmaster? Snowflake? Snowflake's data subprocessors? The manufacturer(s) of the desktop or security apps on the compromised employee's machine? I get your natural but naive reaction, but as someone who just lived through the Sisense breach as neither the original source or end-user, it's much more complicated than you try and present it.
- deleted 2y ago[deleted]
- toofy 2y ago> I get your natural but naive reaction, but as someone who just lived through the Sisense breach as neither the original source or end-user, it's much more complicated than you try and present it. If they find it too complicated to keep our data safe then they shouldnt store it and make billions annually trading in our information. i don’t think it’s unreasonable to expect them to take responsibility for their own actions. either they’re responsible enough to collect our data and use it or they’re not.
- antonioevans 2y agoIsn't this timing weird in that they just got charged by the DOJ with monopoly? "Oh we had a hack, that's why we cannot find the documents, your honor."
- deleted 2y ago[deleted]
- prophesi 2y agoThis is potentially related to the Snowflake breach reported yesterday. https://www.theverge.com/2024/5/31/24168984/ticketmaster-santander-data-breach-snowflake-cloud-storage https://www.theverge.com/2024/5/31/24168984/ticketmaster-san...
- _tk_ 2y agoThere is no confirmation of a "Snowflake breach". Single accounts might have been compromised, but that's all we know for sure so far.
- demondemidi 2y agoWouldn’t the data be worth more than £400k on the black market?
- simonjgreen 2y agoIt’s an interesting question. What’s the going $:identity exchange rate I wonder? Based on this ransom $0.0009 per identity?
- cushpush 2y agoWhere does my convenience fee go if not to securing my data? Court should order a rebrand to Ticketchump
- skissane 2y agoTicketmaster historically has had a very unusual architecture – they wrote their own operating system for the VAX, and ran their core application on top of it. When the VAX reached end-of-life, most users had a migration path elsewhere – VMS users went to Alpha, Unix could either go to Alpha or to a competing Unix platform – Ticketmaster didn't have any such path, because when you write your own operating system, porting it to a new platform is all on you. It didn't help that most (all?) of it was written in assembly language. So they ended up writing their own VAX emulator for Linux, and hence their in-house VAX operating system could continue to run as an app under Linux. And they've been trying for years to get away from all that legacy on to a more mainstream platform. (And for all I know that legacy system is still running today.) But this breach clearly has nothing to do with all that, since it involved a breach of the Snowflake cloud database. So either the legacy system's replacement, or some supporting system. Side note: Terry Davis was one of the developers of Ticketmaster's OS, before he wrote TempleOS, although they created their OS years before he was hired. He credited working on Ticketmaster's OS as part of his inspiration for writing his own
- speedylight 2y agoSituation sounds ripe for a new credit monitoring service, “Creditmaster”. Be the problem, and sell the solution!