\n<\/p>\n
Entertainment giant Live Nation has confirmed its ticketing subsidiary Ticketmaster has been hacked.<\/p>\n
Live Nation confirmed the data breach in a filing with government regulators late on Friday after the markets closed.<\/p>\n
In its statement<\/a>, Live Nation said the breach occurred on May 20, and that a cybercriminal \u201coffered what it alleged to be Company user data for sale via the dark web.\u201d The company did not say who the personal information belongs to, though it\u2019s believed to relate to customers. It\u2019s unclear why it took the company more than a week to publicly disclose the breach.<\/p>\n Live Nation said in its statement that it \u201cidentified unauthorized activity within a third-party cloud database environment containing Company data.\u201d\u00a0<\/p>\n The company did not name the third-party cloud database in its statement.<\/p>\n A spokesperson for Ticketmaster, who would not provide their name but responded from the company\u2019s media email address, told TechCrunch that its stolen database was hosted on Snowflake<\/a>, a Boston-based cloud storage and analytics company.<\/p>\n Ticketmaster\u2019s spokesperson did not say how the data was exfiltrated from Snowflake\u2019s systems.\u00a0<\/p>\n Snowflake said in a post on Friday<\/a> that it had informed a \u201climited number of customers who we believe may have been impacted\u201d by attacks \u201ctargeting some of our customers\u2019 accounts.\u201d Snowflake did not describe the nature of the attacks, or if data had been stolen from customer accounts.<\/p>\n Snowflake spokesperson Danica Stanczak declined to comment on the record about Ticketmaster\u2019s breach.<\/p>\n Amazon Web Services also hosts much of Live Nation and Ticketmaster\u2019s infrastructure, according to a since-removed customer case study<\/a> on Amazon\u2019s website.<\/p>\n Earlier this week, the administrator of a since-revived popular cybercrime forum<\/a> called BreachForums claimed to be selling the personal information of 560 million customers, including the alleged personal information of Ticketmaster customers, along with ticket sales and customer card information.<\/p>\n Until now, Live Nation had not commented on the data breach. Earlier this week, Australian authorities confirmed it was assisting Live Nation with a cybersecurity incident, and U.S. cybersecurity agency CISA deferred comment to Live Nation.<\/p>\n TechCrunch on Friday obtained a portion of the allegedly stolen data containing thousands of records, including email addresses. This included several internal Ticketmaster email addresses used for testing, which are not public but appear as real Ticketmaster accounts.\u00a0TechCrunch verified on Friday that the records we checked belong to Ticketmaster customers.\u00a0<\/p>\n TechCrunch checked the validity of these accounts by running the internal email addresses through Ticketmaster\u2019s sign-up form. All of the accounts came back as real. (Ticketmaster displays an error if someone enters an email address that is already a real Ticketmaster account.)<\/p>\n Earlier in May, the Department of Justice and 30 attorneys general sued Live Nation to break up the ticketing conglomerate, accusing Live Nation of monopolistic practices<\/a>.<\/p>\n Updated with response from Ticketmaster, and Snowflake\u2019s decline.<\/em><\/p>\n Do you know more about the Live Nation TicketMaster breach? Get in touch. To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email.<\/a> You can also send files and documents via SecureDrop<\/a>.<\/em><\/p>\n<\/div>\n
\n