People in UK who bought tickets since February told to be wary of suspicious activity
UK customers of Ticketmaster have been warned they could be at risk of fraud or identity theft after the global ticketing group revealed a major data breach that has affected tens of thousands of people.
The company could face questions over whether there was a delay in disclosing the breach after it emerged that some UK banks have known about the incident since early April.
The Guardian understands that a number of Ticketmaster customers have already had fraudulent transactions debited from their accounts, with the fraudsters spending people’s cash on money transfer service Xendpay, Uber gift cards and Netflix, among other items.
Ticketmaster said customers who bought concert, theatre and sporting event tickets between February and 23 June 2018 may have been affected by the incident, which involved malicious software being used to steal people’s names, addresses, email addresses, phone numbers, payment details and Ticketmaster login details.
The breach also affects customers of two other UK websites owned by Ticketmaster: TicketWeb and the resale website Get Me In!.
The company said less than 5% of its global customer base had been caught up in the breach, and indicated the number directly affected was fewer than 40,000. However, Ticketmaster claims to serve more than 230 million customers a year globally.
Ticketmaster, part of the Live Nation Entertainment group, said that on 23 June it discovered that malware on a customer support product hosted by Inbenta Technologies, an external third-party supplier, was exporting UK customers’ data to an unknown third-party. As a result, it said, some of its customers’ personal or payment information may have been accessed by this third party.
Digital bank Monzo was the first to spot customers’ cards were being compromised. It identified in April that the common factor behind a spike in frauds was that every customer who lost money had also had interaction with Ticketmaster.
On 12 April it warned Ticketmaster of the issue, but “couldn’t get any traction” out of the company, according to Monzo’s head of financial crime, Natasha Vernier.
In the meantime, Monzo contacted all customers who had ever dealt with Ticketmaster – about 5,000 – to replace their cards.
It also told banks that are part of the UK Finance group in April that it was aware of what appeared to be a significant data breach at Ticketmaster.
Monzo’s experience suggests that anyone who has bought a ticket through Ticketmaster should check their accounts for unusual transactions involving Xendpay, Uber and Netflix. None of these companies were involved in the fraud itself, but were the means by which the fraudsters were able to steal money from people’s accounts.
Ticketmaster did not give any further information about precisely which payment details may be affected, but it warned customers: “We recommend that you monitor your account statements for evidence of fraud or identity theft.
“If you are concerned or notice any suspicious activity on your account, you should contact your bank(s) and any credit card companies.”
The company said: “Based on our investigation, we understand that only certain UK customers who purchased or attempted to purchase tickets may have been affected by the incident.”
It added that forensic teams and security experts were “working around the clock” to understand how the data was compromised, and that it was working with the Information Commissioner’s Office, credit card companies, banks and others.
A page on Inbenta’s website – which appears to have been taken down – reveals that Ticketmaster turned to Inbenta because it was having to deal with large numbers of “repetitive questions” from customers “that fatigued agents and cost a lot of money to answer”.
As a result, it said, “Ticketmaster now saves hundreds of thousands of dollars in unnecessary incoming support emails and contact center calls”.
Ticketmaster said it was offering affected customers a free 12-month identity monitoring service. There is a dedicated website, security.ticketmaster.co.uk, and customers can also email fan.help@ticketmaster.co.uk.