If this was Europe, then blame starts and stays with the data controller, Ticketmaster. It can (and might) spread to the data processors that Ticketmaster has

If this was Europe, then blame starts and stays with the data controller, Ticketmaster. It can (and might) spread to the data processors that Ticketmaster has willfully chosen, but that wouldn't clear responsibility for the data controller, who remains accountable.