Cyber Incident Victim: Live Nation Entertainment
Date:
Jun 2018
Location:
United Kingdom
Summary
Ticketmaster experienced a data breach originating from a compromised third-party live chat widget provided by Inbenta, affecting approximately 5% of its global customer base. Malicious code injected into the widget harvested personal and payment information, including names, addresses, email addresses, telephone numbers, payment details, and login credentials from international users who interacted with certain regional sites over several months. North American customers were not impacted. The company detected the unauthorized activity, disabled the affected widget, and notified potentially impacted individuals, offering identity monitoring services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Ticketmaster publicly disclosed a data breach on June 27, 2018, revealing that malicious activity had been detected four days earlier on June 23. The intrusion originated not within Ticketmaster's own systems but through a compromised third-party live chat widget supplied by Inbenta Technologies, an AI-powered customer service provider deployed on Ticketmaster's international websites. Attackers injected malicious code into this widget, enabling the covert logging and exfiltration of customer data during transactional interactions. The malicious data collection operated undetected for extended periods—impacting international customers who purchased or attempted to purchase tickets between September 2017 and June 23, 2018, with a shorter exposure window from February to June 23, 2018, affecting UK website users exclusively. North American customers were not impacted by this incident.
The compromised data included names, addresses, email addresses, telephone numbers, payment card details, and Ticketmaster login credentials. Ticketmaster immediately disabled the Inbenta widget across all properties upon discovering the breach on June 23. The company conducted internal investigations to determine scope while notifying potentially affected customers via direct email communications. For UK users specifically impacted, Ticketmaster established a dedicated webpage offering 12 months of complimentary identity monitoring services. Inbenta did not publicly comment on the incident during initial reporting, though security analysts noted its client portfolio included other major brands like Groupon and Change.org. The breach marked another high-profile case of supply chain compromise via customer support tools, following similar incidents earlier in 2018 involving7.ai's chat systems affecting Sears, Delta Airlines, and Best Buy customers. Ticketmaster confirmed the attacker exclusively targeted its international platforms, with no evidence of North American system infiltration.