Ticketcounter Exposes 1.9 M Customer Records After Public Backup Leak
What Happened — In August 2020 Ticketcounter unintentionally placed a full database backup in a publicly reachable location. The backup was discovered and downloaded in February 2021, exposing 1,921,722 records that included names, emails, physical and IP addresses, dates of birth, genders, payment histories, bank account numbers, and phone numbers. The data was later offered for sale on a hacking forum and the company received a ransom demand threatening public release.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous control‑assurance program is built to prevent: undocumented data‑store locations and lack of real‑time evidence that backups are secured.
- Mapping the backup‑storage control to the VCF spine provides a single, auditable evidence point that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
- Leveraging Verisq’s Control Mapping capability lets you capture, monitor, and report on backup‑handling controls continuously, creating a defensible audit trail.
Who Is Affected – Retail/e‑commerce and event‑ticketing organizations that store customer payment and personally identifiable information.
Recommended Actions
- Inventory all backup repositories and enforce strict access controls.
- Deploy continuous monitoring to detect publicly exposed storage assets.
- Update data‑handling policies to require documented approval and encryption for backups.
- Collect and retain evidence of backup security for audit readiness.
Technical Notes – Attack vector: misconfiguration (publicly exposed backup). No vulnerability identifier (CVE). Exfiltrated data types: personal identifiers, financial details, payment histories, IP addresses.