A big problem for the company and its customers
A data breach in which the personal data of 560 million people was stolen. A huge reputational hit for Ticketmaster, a serious threat to the data owners that ended up in the hackers’ hands. The company, owned by Live Nation Entertainment, was the victim of an attack that resulted in the manipulation of a 1.3 terabyte database, which was later offered for sale online for $500,000. The criminal action was claimed by ShinyHunters, a hacking group known for other similar actions, who claimed to have contacted the leading event ticketing company to negotiate a ransom but received no response.
Santander Bank also breached
The cybercriminal organisation, which has been active for four years, can claim breaches against many well-known brands, including Microsoft, At&T and Pluto TV. Although several members have been caught and sentenced to several years in prison for identity theft, computer fraud and the illegal acquisition of sensitive data, the group has continued to operate even after the police shut down the online forum it ran.
As well as Ticketmaster, ShinyHunters also attacked Santander Bank, stealing the personal details of around 30 million customers. After a period of silence following the criminals’ claim in the final days of last month, Live Nation confirmed the breach in a letter to the SEC (the stock market watchdog has introduced a rule requiring listed companies to disclose relevant data breaches within four days of the attack), pointing to the identification of unauthorised activity linked to a third-party cloud database and launching an internal investigation to understand what had happened.
Complicated time for Live Nation
Beyond the company’s defence, the problem is an enormous amount of data stolen from the servers. But that’s not all: the data that ended up in the hands of the cyber criminals included names, surnames, addresses, email addresses, telephone numbers and details of previous purchases from Ticketmaster. To this is added the data of the credit cards used for the transactions, although in this case, it is only partial data, with the expiry date of the card and the last four digits. Although this is not enough to steal money from a user’s account, it does allow hackers to launch more effective phishing attacks. Ticketmaster customers are advised to change their passwords, monitor their bank accounts, and be alerted to suspicious emails and messages.
Already under investigation by the US Department of Justice for allegedly monopolising the live concert sector and violating antitrust, competition and unfair trade practices laws, the latest breach comes on top of last January’s attack, which forced Ticketmaster to suspend ticket sales for Taylor Swift’s tour. The black period was capped off by a class action lawsuit filed by two Californian customers alleging that the company failed to adequately protect their personal information, with the breach causing anxiety and stress to the plaintiffs.
The vulnerability that enabled the cyber criminals’ attack is unknown
However, there may be a way for Live Nation to deflect the accusations that have come from many quarters, and according to an investigation by cybersecurity firm Hudson Rock, the criminal mastermind behind the attack gained access to Ticketmaster and Santander data via credentials stolen from a Snowflake employee. By bypassing the Okta authentication service, the hacker allegedly generated session tokens to steal a range of information from Snowflake. It’s a move that could have opened the door to other databases, as the cloud storage company’s customers include giants such as HP, DoorDash, Mastercard and NBC Universal, as well as the two companies already mentioned.
This scenario was promptly denied by Snowflake itself, which claimed that the breaches were generated by accounts with little or no protection. Under pressure from the latter, Hudson Rock thus withdrew its report. Beyond the skirmishes, it will take some time to analyse and understand what happened and find the vulnerability that allowed the criminals to get in. Hopefully, none of the customers whose data was stolen will have any nasty surprises.
