Ticketmaster UK is the next victim in a data breach

[ItsMitch]

S: Ticketmaster & ICO

Ticketmaster UK has confirmed to the authorities and to ICO (Information Commissioner's Office) teams they have suffered a data breach on the 23rd of June (They have confirmed it today) the timing is in line with the new EU GDPR guidelines on disclosing any kind of data breaches to the potential victims. Ticketmaster also believes they have acted "very well" in accordance to GDPR guidelines on full disclosure. 

Quote

What Happened?

On Saturday, June 23, 2018, Ticketmaster UK identified malicious software on a customer support product hosted by Inbenta Technologies, an external third-party supplier to Ticketmaster.

As soon as we discovered the malicious software, we disabled the Inbenta product across all Ticketmaster websites.

Less than 5% of our global customer base has been affected by this incident. Customers in North America have not been affected.

As a result of Inbenta's product running on Ticketmaster International websites, some of our customers' personal or payment information may have been accessed by an unknown third-party.

We have contacted customers who may have been affected by the security incident. UK customers who purchased, or attempted to purchase, tickets between February and June 23, 2018 may be affected as well as international customers who purchased, or attempted to purchase, tickets between September 2017 and June 23, 2018.

If you have not received an email, we do not believe you have been affected by this security incident based on our investigations.

Forensic teams and security experts are working around the clock to understand how the data was compromised.

We are working with relevant authorities, as well as credit card companies and banks.

(Bolded data is important)

 

What was breached? 

Ticketmaster believe from their internal review that: Email addresses, passwords, telephone numbers, payment details and Ticketmaster login credentials was stolen from their servers. 

Will I be contacted?

Yes, Ticketmaster will be sending out emails to all its users to inform them.

 

My personal thoughts on this are fairly simple, it's good that Ticketmaster quickly disclosed the issues to the authorities and to it's customers, it's sad that it's reputation will take a hit although, but that's the costs of having a data breach. 

 

E: 

Quote

Based on our investigation, we understand that only certain UK customers who purchased or attempted to purchase tickets may have been affected by the incident. As a precaution we are also notifying all Ticketmaster International customers outside the UK that they will need to reset their passwords when they next log into their accounts. Customers in North America are not affected.

 

[sazrocks]

10 minutes ago, SC2Mitch said:

passwords

If that's true Ticketmaster is going to be in for a world of hurt. You never, ever store passwords in plaintext on anything. That behavior is so negligent that I wouldn't be surprised to hear of lawsuits soon.

 

Of course, that's if the article wasn't overstating.

[ItsMitch]

3 minutes ago, sazrocks said:

If that's true Ticketmaster is going to be in for a world of hurt. You never, ever store passwords in plaintext on anything. That behavior is so negligent that I wouldn't be surprised to hear of lawsuits soon.

 

Yeah, Ticketmaster being very sparse on the password details. They did add this at the FAQ which I missed. 

 

14 minutes ago, SC2Mitch said:

Quote

Based on our investigation, we understand that only certain UK customers who purchased or attempted to purchase tickets may have been affected by the incident. As a precaution we are also notifying all Ticketmaster International customers outside the UK that they will need to reset their passwords when they next log into their accounts. Customers in North America are not affected.