Fanpass Ticket Marketplace Breach Exposes 112,251 Customer Records
What Happened — In April 2022 the UK‑based ticket resale site Fanpass suffered a data breach that released the personal details of 112,251 customers. The exposed data set includes names, phone numbers, physical addresses, purchase histories, gender, partial dates of birth, and salted password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and weak access‑control safeguards – a core control area that continuous‑monitoring programs are built to verify.
- Highlights the need for defensible evidence that password storage follows industry‑accepted hashing standards and that privileged accounts are tightly managed.
- Provides a real‑world trigger for audit‑readiness checks against access‑control objectives across multiple frameworks.
Who Is Affected – Online ticket resale platforms, broader e‑commerce retailers handling personal data, and any service that stores customer credentials.
Recommended Actions
- Conduct an immediate review of password‑storage practices (hashing algorithm, salting, iteration count).
- Enforce multi‑factor authentication for all privileged and administrative accounts.
- Map your credential‑management processes to the “Identity & Access Management” control objective and collect evidence for audit readiness.
Technical Notes – The breach was disclosed via Have I Been Pwned; the exact attack vector was not publicly detailed, but the presence of salted password hashes suggests credential‑store compromise, possibly through credential stuffing or insider misuse. Source: https://haveibeenpwned.com/api/v3/breach/Fanpass