Ticketfly Breach Exposes 26.1 M User Records After Website Defacement
What Happened – In May 2018 the public Ticketfly website was defaced by an attacker. After receiving no ransom response, the threat actor posted a data dump containing 26,151,608 unique email addresses, names, phone numbers and physical addresses to a publicly‑accessible location. Ticketfly later warned that hashed password values may also have been accessed.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of web‑application integrity could have detected the defacement earlier, providing evidence for a defensible audit trail.
- Robust third‑party risk oversight (evidence of security hygiene, patching, and incident‑response readiness) is a core control that mitigates exposure of customer data.
- Documented incident‑response procedures and evidence collection are essential to demonstrate due‑diligence to regulators and partners.
Who Is Affected – Event‑ticketing platforms, entertainment promoters, and any organization that relied on Ticketfly’s SaaS service for ticket sales.
Recommended Actions – Map this incident to your vendor‑risk control objectives, collect evidence of web‑application security controls (e.g., WAF logs, patch status), and validate that continuous monitoring and incident‑response processes are documented and testable. Source: Have I Been Pwned – Ticketfly breach
Technical Notes – The attacker leveraged a website defacement (vector not publicly disclosed) and subsequently exfiltrated user records; no passwords were released, though password hashes may have been compromised. Source: same as above