Central Tickets Breach Exposes 722,860 Customer Records and Weakly‑Hashed Passwords
What Happened – In September 2024 data from the UK ticket‑selling platform Central Tickets was posted to a public hacking forum. The leak, which appears to stem from an earlier compromise, contains 722,860 unique email addresses together with names, phone numbers, IP addresses, purchase histories and passwords stored as unsalted SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Weak credential storage violates best‑practice control objectives for protecting authentication secrets and makes it difficult to provide a defensible audit trail.
- Continuous monitoring of credential‑hash health and evidence of strong hashing policies are core to a control‑assurance program.
- The incident illustrates the need for documented password‑management controls that can be demonstrated to auditors and regulators.
Who Is Affected – Ticketing and event‑management SaaS providers, retail/e‑commerce platforms that handle customer payments, and the 722 k individuals whose personal data was exposed.
Recommended Actions
- Replace unsalted SHA‑1 hashes with a modern, salted algorithm such as bcrypt or Argon2 for all stored passwords.
- Enforce multi‑factor authentication and strong password policies for all user accounts.
- Deploy credential‑exposure monitoring to detect future leaks of password hashes.
- Update incident‑response playbooks to include specific steps for credential‑hash compromise and evidence collection.
Source: Have I Been Pwned – Central Tickets breach
Technical Notes – The breach includes device information, email addresses, IP addresses, names, passwords (unsalted SHA‑1), phone numbers and purchase data. The exact attack vector remains unknown; the data suggests the compromise occurred months before public disclosure. Source: same as above