HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)LowContained

Ticketmaster Entertainment, Inc.

bd_be89dbb70b4a0849 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 23, 2024

Filed

Jun 27, 2024

To disclose

5 weeks

Affected

1state residents only

Linked

9 filings

Confidence

65%

Full breach record for Ticketmaster Entertainment, Inc. →3 incidents on file

Ticketmaster LLC notified Montana residents of a data breach involving unauthorized access to a third-party cloud database between April 2 and May 18, 2024. The incident may have exposed names and basic contact information. Ticketmaster engaged outside experts, cooperated with federal law enforcement, reset passwords, and offered one year of identity monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 5 weeks / 35 days

Apr 2, 2024

Begins

May 23, 2024

Discovered

Jun 27, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_bf0a03842a98127d2024-06-27Verified
Indiana State AGbd_c57115259345cf712024-06-27Verified
South Carolina State AGbd_2da6e0db70523db82024-06-28 · +1dVerified
Maine State AGbd_deb6d2a5bcc2b0c92024-06-28 · +1dVerified

Show 4 more filings ↓up to 11d gap

Oregon State AGbd_ce6ee95d5ed867772024-06-26 · +1dVerified
Washington State AGbd_1babfd28d1ac20952024-06-22 · +5dCandidate
Vermont State AGbd_e9e9b2d5155b036f2024-07-05 · +8dVerified
Delaware State AGbd_270eb6419dac56142024-07-08 · +11dVerified

Name: Ticketmaster Entertainment, Inc.
norm: ticketmaster entertainment
Domain: ticketmaster.com

Name: Ticketmaster Entertainment, Inc.
norm: ticketmaster entertainment
Domain: ticketmaster.com
Industry: Retail & Consumerllm

Discovered: May 23, 2024
Breach occurred: Apr 2, 2024 – May 18, 2024
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Cooperating with federal law enforcement authorities
Initial access: trusted_relationship

During the incident: Investigating this incident with the assistance of outside experts
Contacted and cooperating with federal law enforcement authorities
Rotating passwords for all accounts associated with the affected cloud database
Reviewing access permissions
Increased alerting mechanisms deployed in the environment
Offering identity monitoring with TransUnion at no cost
Changes made: Rotating passwords for all accounts associated with the affected cloud database
Reviewing access permissions
Increased alerting mechanisms deployed in the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Washington State AGJun 22 · first

Oregon State AG+4d

California State AG+5d

Indiana State AG+5d

Montana State AG+5d · this page

South Carolina State AG+6d

Maine State AG+6d

Vermont State AG+13d

Delaware State AG+16d

Pattern: first filing Jun 22 (WA), last Jul 8 (DE) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 27, 2024
Raw hash: 450c8e458efb1977c26fa991e9e8c50744bfa9400b6144c01fb5dd81fafd347e

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTicketmaster Entertainment, Inc.

Victim entityTicketmaster Entertainment, Inc.

Incidentdiscovered May 23, 2024

Stated responseInvestigating this incident with the assistance of outside experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov