Recommended Free Tools
The Ticketmaster breach was real, but the headline figure of 560 million affected customers has not been independently verified. Live Nation confirmed unauthorized activity in a third-party cloud database containing primarily Ticketmaster data. Ticketmaster says some customers who bought tickets to events in the United States, Canada or Mexico may have had personal information involved; it says customer accounts were not affected.
What Ticketmaster and Live Nation confirmed
In a May 31, 2024 filing, Live Nation said it detected unauthorized activity on May 20 in a third-party cloud database environment containing company data, primarily from Ticketmaster. The company also said that on May 27 a criminal actor offered alleged company user data for sale. These are the company’s confirmed disclosures; they do not verify the full contents or scale of the advertised dataset. Read Live Nation’s SEC filing.
Ticketmaster’s customer notice describes an isolated third-party cloud database containing limited personal information belonging to some customers who bought tickets to events in the U.S., Canada and/or Mexico. Ticketmaster says it is contacting relevant customers directly. Read Ticketmaster’s incident notice.
Where the 560 million figure came from
The number came from a listing attributed to the ShinyHunters cybercrime group. The listing allegedly claimed data relating to about 560 million customers and approximately 1.3 terabytes of material. Those figures were repeated in lawsuit filings, but neither the unique-person count nor the completeness of the dataset has been independently established. A record count may not equal a count of distinct people or current account holders. See the complaint that repeats the alleged listing.
#1 Best Overall
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTED – The PIN used to unlock OnlyKey is entered directly on it. This means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN –No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
A later complaint described an alleged asking price of roughly $500,000. An offer for sale is not proof of a completed sale, and the cited official filing does not establish that Ticketmaster or Live Nation paid a ransom. See the later class-action filing.
Timeline of the incident
- April 2–May 18, 2024: A South Carolina breach notice attributed unauthorized activity to this period. This is a state-specific notice, not a statement that every customer’s data was accessed throughout that period. South Carolina notice.
- May 20, 2024: Live Nation said it identified unauthorized activity in a third-party cloud database.
- May 27, 2024: Live Nation said an actor offered alleged company user data for sale.
- May 28, 2024: Lawsuit filings said the data was advertised on BreachForums. That is an allegation in litigation, not a final forensic finding.
- May 31, 2024: Live Nation disclosed the incident in an SEC filing. SEC filing index.
- June 2024 onward: Ticketmaster issued customer notifications and state breach notices. Eligible customers were offered 12 months of identity or credit monitoring, according to Ticketmaster’s notice.
What information may have been exposed
Ticketmaster says the database may have contained email addresses, phone numbers, encrypted credit-card information and other personal information supplied by customers. The alleged attacker listing and legal complaints also described names, contact details, ticket-sale or order information and partial payment-card details. Treat the latter details as claims about the advertised dataset rather than a verified inventory of what was accessed.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Payment-card descriptions vary by source. Ticketmaster refers to encrypted credit-card information; state notices describe hashed or masked card data. The public material cited here does not establish that attackers obtained complete, unencrypted card numbers or security codes. Partial details may help criminals make phishing messages more convincing, even when they are not sufficient on their own for ordinary card-not-present purchases. Keep an eye on payment activity and contact your card issuer about anything unfamiliar.
Passport numbers appear in a North Carolina notice for a limited number of people. That state-specific disclosure should not be generalized to all Ticketmaster customers. North Carolina Department of Justice report.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Were Ticketmaster passwords or accounts affected?
Ticketmaster says customer accounts were not affected and customers do not need to reset their Ticketmaster passwords because of this incident. A database containing personal or transaction information is not necessarily the same system as the live login system. This is Ticketmaster’s stated position, not an independently published forensic conclusion.
If you reused your Ticketmaster password on another service, change it on those other services and use a different, strong password for each. Enable multifactor authentication wherever available. A breach of personal data can create phishing and identity risks even when login credentials are not involved.
How to check whether you were notified
Ticketmaster says it contacts relevant customers by email or first-class mail. It says that if you are not contacted, it does not believe your sensitive information was involved. Check both inbox and physical mail, including older addresses if you moved since buying tickets.
- Look for a direct Ticketmaster incident notice, but do not use links or phone numbers in a message you cannot verify.
- Open Ticketmaster by typing its known official address into your browser or using a saved bookmark, then check the company’s incident page.
- For payment questions, call the number printed on your card or use your card issuer’s official website.
- Be cautious with third-party breach-checking sites. Do not submit extra personal information just to learn whether an email address appears in a database.
What affected customers should do
- Monitor accounts: Review bank and card statements for unfamiliar transactions. Contact the issuer promptly if you see suspicious activity.
- Use the free offer if eligible: If Ticketmaster directly notified you and offered 12 months of monitoring, follow the enrollment instructions in the verified notice.
- Protect reused credentials: Change passwords reused on other sites and enable multifactor authentication where possible.
- Be alert for identity misuse: If the notice says identity details such as passport information were involved, consider a fraud alert or credit freeze through the relevant credit bureaus. A freeze can make it harder for someone to open new credit in your name, but it does not stop phishing or misuse of existing cards.
- Keep records: Save the notice and correspondence in case you need them for a dispute or future identity-theft response.
Ticketmaster specifically advises customers to monitor bank accounts and credit cards and to be wary of unsolicited emails, links, attachments and phone requests for personal information. Ticketmaster’s guidance.
Best Value
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Watch for event-related follow-up scams
Criminals can use exposed contact or order details to make a fake message feel credible. A message that names a real concert, venue, order date or ticket problem is not automatically genuine. Be especially skeptical of claims about refunds, ticket transfers, account verification or urgent support action.
- Do not share passwords, one-time login codes, full card details or identity documents in response to an unsolicited message.
- Do not pay with gift cards, cryptocurrency or an unexpected wire transfer to resolve a supposed ticket issue.
- Do not open unexpected attachments or sign in through a link in a message.
- Contact Ticketmaster through its official site or app, and contact your bank through a number or address you independently know is genuine.
Was Snowflake responsible?
Some reports connected the incident to a broader wave of attacks involving Snowflake-hosted customer environments. Live Nation’s cited SEC disclosure identifies a third-party cloud database environment but does not name Snowflake. The available primary disclosure therefore does not establish that Snowflake was breached or caused the Ticketmaster incident. Live Nation’s filing.
What lawsuits do—and do not—show
Class-action complaints alleged that information relating to approximately 560 million customers was exposed and accused Ticketmaster and Live Nation of inadequate security. Those are plaintiffs’ allegations, not findings that establish the number of affected people, the exact data accessed or liability. Anderson complaint.
Quick Recap
What remains unverified
- That 560 million distinct people were affected; the figure is an alleged attacker claim.
- That every record in the advertised dataset was authentic, complete, unique or obtained in this incident.
- That full, usable card numbers, security codes or Ticketmaster passwords were exposed.
- That the breach was caused by Snowflake, or that Ticketmaster or Live Nation paid a ransom.
- That every Ticketmaster customer worldwide was affected; Ticketmaster’s notice discusses some customers who bought tickets to events in the U.S., Canada and/or Mexico.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
