Entertainment giant Live Nation has confirmed that its ticket sales subsidiary, Ticketmaster, has been hacked.
Live Nation confirmed the data breach in a filing with government regulators late Friday after markets closed.
Live Nation said in a statement that it had “identified unauthorized activity within a third-party cloud database environment containing company data.”
The company did not name the third-party cloud database. Amazon Web Services hosts much of Live Nation and Ticketmaster's infrastructure, according to customer case studies that have since been removed from Amazon's website.
Live Nation said the breach occurred on May 20 and that on May 27, cybercriminals “offered what appeared to be company user data for sale via the dark web.” The company did not disclose to whom the personal information belongs, but it is believed to be related to customers.
A Live Nation spokesperson did not immediately respond to requests for comment from TechCrunch on Friday or over the past few days. It's unclear why it took the company more than a week to disclose the breach.
Earlier this week, administrators of the popular cybercrime forum BreachForums claimed they were selling the personal information of 560 million customers, including what was believed to be the personal information of Ticketmaster customers, along with ticket sales and loyalty card information.
So far, Live Nation has not commented on the alleged data breach. Earlier this week, Australian authorities confirmed they were assisting Live Nation with a cybersecurity incident, while U.S. cybersecurity agency CISA deferred comment on Live Nation.
On Friday, TechCrunch obtained some of the alleged stolen data, which included thousands of records, including email addresses. Although not disclosed here, several internal Ticketmaster email addresses used in testing found in the dataset appear to be real Ticketmaster accounts. TechCrunch checked and confirmed that the records we saw on Friday belonged to Ticketmaster customers.
TechCrunch confirmed the validity of these accounts by running internal email addresses through Ticketmaster's sign-up form. All accounts are back real. (If someone enters an email address that is already a real Ticketmaster account, Ticketmaster will display an error.)
In early May, the Justice Department and 30 attorneys general sued Live Nation in a bid to break up the ticket sales giant, accusing it of monopolistic behavior.
Do you know more about the Live Nation TicketMaster breach? Please contact us. To contact this reporter, call +1 646-755-8849 or email on Signal and WhatsApp. You can also send files and documents via SecureDrop.
