Cyber Incident Victim: Ticketmaster UK
Date:
Jul 2020
Location:
United Kingdom
Summary
A database containing 4.8 million customer emails and usernames linked to a prominent UK ticketing provider was discovered for sale on the dark web, advertised by a seller using a Russian contact email. The compromised records, primarily affecting users in the UK, US, and several other countries, exposed individuals to heightened risks of phishing and credential stuffing attacks. While the seller falsely attributed the data to a shopping and forex platform, analysts confirmed its connection to the ticketing service, which had previously experienced website defacement and appeared on a list of SQL injection-vulnerable sites. The incident highlighted broader organizational risks including potential fraud costs, customer attrition, and operational disruptions stemming from such breaches.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 8, 2020, a database containing 4.8 million email addresses and usernames linked to a prominent UK-based live event ticketing provider appeared for sale on a dark web marketplace. The listing was posted by a new user identified as "Jamescarter," who priced the dataset at $2,500 and provided a .ru email address for contact. Cyber-intelligence firm KELA discovered the listing and acquired a sample of 10,000 records for analysis, confirming only 300 (3%) were duplicates. While the seller claimed the data originated from a "shopping and forex trading site," KELA attributed the records to customers of the UK ticketing service based on investigative findings. The dataset primarily contained commercial webmail addresses but also included government domain accounts, elevating risks for high-value targets. Affected users spanned multiple countries, with concentrations in the UK, US, New Zealand, Australia, South Africa, Germany, and France.
The exposure placed affected customers at heightened risk of phishing campaigns and credential stuffing attacks, where stolen credentials are reused to compromise other accounts. KELA noted the ticketing provider had previously experienced website defacement and was listed on Pastebin among sites vulnerable to SQL injection attacks, though no confirmed connection existed between these prior incidents and the 2020 breach. Credential stuffing attacks were estimated to cost EMEA organizations approximately $4 million annually prior to this incident, factoring in application downtime, customer attrition, increased IT security workloads, and subsequent fraud losses. The sale listing remained active following its July 8 posting, with no disclosed remediation actions or public statements from the affected organization in the available source material.