Data leak at Ticketmaster

On 28 April 2024, Ticketmaster — the world's largest ticketing platform, owned by Live Nation Entertainment — fell victim to one of the largest data breaches on record. Rather than a direct intrusion into Ticketmaster's own systems, attackers exfiltrated data from a third-party cloud data warehouse hosted on Snowflake, part of a wider campaign that also hit Santander and other Snowflake customers.

The threat actor group ShinyHunters accessed the Snowflake environment using credentials stolen by info-stealing malware, targeting accounts that lacked multi-factor authentication. Unauthorized activity took place roughly between early April and mid-May 2024; Live Nation identified the intrusion on 20 May 2024, and on 27 May the stolen database — around 1.3 TB — was advertised for sale on a cybercrime forum for about $500,000. Live Nation confirmed the incident in an SEC 8-K filing on 31 May 2024.

The data offered for sale reportedly covered up to 560 million customers and included:

• First and last names
• Email and postal addresses
• Phone numbers
• Transaction and order history
• Partial payment-card data (last four digits and card expiry dates)

Live Nation stated the incident was not expected to have a material impact on its operations and worked with forensic investigators and authorities; Snowflake denied any vulnerability in its own platform, attributing the compromise to stolen customer credentials and missing MFA. The breach triggered class-action lawsuits and regulatory scrutiny across multiple jurisdictions.