HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPIIMediumContained

Ticketmaster Entertainment, Inc.

bd_1babfd28d1ac2095 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2024

Filed

Jun 22, 2024

To disclose

4 weeks

Affected

500state residents only

Linked

10 filings

Confidence

70%

Full breach record for Ticketmaster Entertainment, Inc. →2 incidents on file

Ticketmaster LLC reported a data breach affecting up to 500 Washington residents. Unauthorized access occurred between April 2 and May 18, 2024, involving a third-party cloud database. Personal information, including names and contact details, was potentially accessed. Ticketmaster engaged outside experts, notified federal law enforcement, reset passwords, and offered 1 year of TransUnion identity monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 51 days

discovery → filing · 4 weeks / 30 days

Apr 2, 2024

Begins

May 23, 2024

Discovered

Jun 22, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_ce6ee95d5ed867772024-06-26 · +4dVerified
Montana State AGbd_be89dbb70b4a08492024-06-27 · +5dVerified
California State AGbd_bf0a03842a98127d2024-06-27 · +5dVerified
Indiana State AGbd_c57115259345cf712024-06-27 · +5dVerified

Show 5 more filings ↓up to 21d gap

South Carolina State AGbd_2da6e0db70523db82024-06-28 · +6dVerified
Maine State AGbd_deb6d2a5bcc2b0c92024-06-28 · +6dVerified
Vermont State AGbd_e9e9b2d5155b036f2024-07-05 · +13dVerified
Delaware State AGbd_270eb6419dac56142024-07-08 · +16dVerified
Illinois State AGbd_8fc9f3485cb0e6562024-06-01 · +21dVerified by operator

Name: Ticketmaster Entertainment, Inc.
norm: ticketmaster entertainment
Domain: ticketmaster.com

Name: Ticketmaster Entertainment, Inc.
norm: ticketmaster entertainment
Domain: ticketmaster.com
Industry: Retail & Consumerllm

Discovered: May 23, 2024
Breach occurred: Apr 2, 2024 – May 18, 2024
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 500state-resident count only
Data types: PIIIdentity (basic)
Data elements: NameFinancial account numberDate of birthPassport numberSocial Security number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Cooperating with federal law enforcement authorities
Initial access: valid_credentials

During the incident: Investigating this incident with the assistance of outside experts
Contacted and are cooperating with federal law enforcement authorities
Rotating passwords for all accounts associated with the affected cloud database
Reviewing access permissions
Increased alerting mechanisms deployed in the environment
Offering identity monitoring with TransUnion at no cost
Changes made: Rotating passwords for all accounts associated with the affected cloud database
Reviewing access permissions
Increased alerting mechanisms deployed in the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJun 1 · first

Washington State AG+21d · this page

Oregon State AG+25d

Montana State AG+26d

California State AG+26d

Indiana State AG+26d

South Carolina State AG+27d

Maine State AG+27d

Vermont State AG+34d

Delaware State AG+37d

Pattern: first filing Jun 1 (IL), last Jul 8 (DE) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29588.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2024
Raw hash: 7425bead9df7eaa73df62b193e61536ee3bc36536d393c592699a01ad9bdddda

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityTicketmaster Entertainment, Inc.

Victim entityTicketmaster Entertainment, Inc.

Incidentdiscovered May 23, 2024

Stated responseInvestigating this incident with the assistance of outside experts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com