Ticketmaster’s bad month may be getting even worse. A hacking group that calls itself ShinyHunters has claimed to have completed a Ticketmaster hack, bypassing the ticket service’s security measures to steal the personal data of 560 million users. The hackers are reportedly trying to sell the data for $500 million.
Cybersecurity news service HackRead reports the group claims to have gained access to full names, addresses, email addresses, phone numbers, partial payment card data, and the ordering history of Ticketmaster users (among other data points). The data, as shown on the hacker site, fills 1.3 terabytes.
Ticketmaster has not yet commented publicly about the veracity of the claims, and it did not respond to Fast Company’s request for comment about the reported hack. But so far, at least one country has spoken out about the alleged Ticketmaster hack. A statement by Australia’s Department of Home Affairs confirmed the legitimacy of the report, and officials said they were “working with Ticketmaster to understand the incident.”
Officials in Australia say the data stolen could put consumers at risk of identity fraud and phishing at the very least.
ShinyHunters is a black-hat group that’s well known in the cybersecurity world, with a long history of attacks. In the past, it has offered information from companies including AT&T (with information on 70 million wireless customers, including social security numbers), Microsoft (where it stole source code from a private GitHub account), and Bonobos (where it gained access to personal data for 7 million customers).
The Federal Bureau of Investigation (FBI) has an ongoing investigation into the group, which earlier this year resulted in the sentencing of one member, who now faces three years in prison and was ordered to return $5 million.
The reported Ticketmaster hack comes just days after the U.S. Department of Justice (DOJ) and a collection of states filed an antitrust suit against Ticketmaster parent company Live Nation, seeking to break up the company. Attorney General Merrick Garland, when announcing the suit, said, “It is time to break up Live Nation-Ticketmaster.” The company almost immediately replied, “Calling Ticketmaster a monopoly may be a PR win for the DOJ in the short term, but it will lose in court because it ignores the basic economics of live entertainment.”
Ticketmaster, meanwhile, has been struggling to improve its reputation with consumers for more than a year. The phenomenal demand for tickets to Taylor Swift’s Eras Tour and the meltdown of Ticketmaster’s site left many people without a seat—and none too happy about that. That incident put a spotlight on the company—especially when it delayed its general sale event.
The Senate Judiciary Committee later convened for a hearing looking at the live entertainment ticketing industry, which helped lead to the antitrust suit.
The company attempted some PR fence-mending earlier this month, with its $25 ticket sale for over 5,000 shows and concerts this summer. That backfired, somewhat, though, as Ticketmaster’s servers once again collapsed, resulting in page-loading errors and “page not found” notifications. Some customers who were in the queue for tickets saw wait times for a half hour or more when tickets went on sale, only to be met with an error when their time to purchase arrived.
Should the hackers sell the data and cause further inconveniences for consumers, it could dig an even deeper reputational hole for Ticketmaster, despite the fact that large-scale data theft occurs to a wide variety of businesses today. (UnitedHealth Group was attacked in February of this year, which resulted in some people being unable to fill prescriptions and the possible theft of personal data for a “substantial proportion” of Americans. And last month, the Biden administration warned the nation’s ports to firm up their defenses as foreign-operative hackers targeted key parts of the U.S. infrastructure.)
Shares of Live Nation were largely flat in midday trading.