Ticketmaster has confirmed recent reports of a data breach in a new filing with the US Securities and Exchange Commission (SEC).
Live Nation (which merged with Ticketmaster in 2010) filed a new Form 8-K filing in which it said on May 20 that it “identified unauthorized activity within a third-party cloud database environment that contained company data (primarily from Ticketmaster LLC’s subsidiary). ”
Further investigation revealed that on May 27, a threat actor attempted to sell the stolen data on the dark web.
Snowflake goes to investigate
The filing does not specify which third-party cloud database provider Live Nation was referring to, but an unnamed spokesperson for Ticketmaster said TechCrunch it was Snowflake. They didn’t specify exactly how Snowflake was breached, but the company did post a breach notice on its website.
“Snowflake has recently observed and is investigating an increase in cyber threat activity targeting the accounts of some of our customers,” the report said.
“We believe this is the result of ongoing industry-wide identity-based attacks aimed at obtaining customer data.” The company doesn’t think it’s vulnerable in any way, doesn’t have misconfigured systems or anything like that, but instead thinks it’s the victim of credential-stuffing attacks where threat actors have obtained the necessary information elsewhere.
“Research shows that these types of attacks are being carried out using our customers’ user data, which has been exposed through unrelated cyber threats.”
Both Snowflake and Ticketmaster confirmed they have notified affected individuals, with the latter also saying it has notified police and is cooperating with the ongoing investigation.
“Where appropriate, we also notify regulators and users regarding unauthorized access to personal information,” Ticketmaster told the SEC.
Finally, the company said it does not believe the incident will have any material impact on its business operations.