Ticketmaster Faces Class Action Lawsuit Over Data Breach That Exposed User’s Private Information

Following the recent revelation that a Ticketmaster data breach compromised the personal information of more than half a billion customers, the company faces a class action lawsuit seeking damages on behalf of all individuals who now may face an increased risk of identity theft and financial damages.

On Friday, Ticketmaster’s parent company, Live Nation, confirmed the data breach in a report to the U.S. Securities and Exchange Commission, indicating that hackers were selling personal identifying information (PII) on the dark web, which it now appears was obtained from a Ticketmaster security failure. The breach is believed to have led to the leak of more than 560 million customers’ data.

The Ticketmaster data breach allegedly compromised the names, home addresses, emails, phone numbers, ticket purchases, and partial credit card data, such as the last four digits of the card numbers and expiration dates, according to various tech industry news publications.

In the filing submitted on May 31, Live Nation stated that it “identified unauthorized activity within a third party cloud database environment” on May 20, which contained data primarily from its Ticketmaster subsidiary. The company launched an investigation and discovered “user data for sale via the dark web” on May 27, 2024.

“We are working to mitigate risk to our users and the Company, and have notified and are cooperating with law enforcement,” said Live Nation in the statement. “As of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations.”

However, the statement does not address the impact of the Ticketmaster data breach on customers, or the extent of liability the company may face for their role is in the release of Ticketmaster user data.

Ticketmaster Class Action Lawsuit Seeks Damages for All Users

Just days before Live Nation confirmed the breach, a complaint (PDF) was filed by Cynthia Ryan and Rosalia Garcia in the U.S. District Court for the Central District of California on May 29, seeking class action status to pursue damages for all impacted customers from Ticketmaster and Live Nation Entertainment, Inc. who were named as defendants.

The Ticketmaster class action lawsuit blames the breach on failures to properly secure consumers’ sensitive information, and also claims the companies have been slow to acknowledge the breach and warn consumers whether they have been affected, and how. It warns that the private information accessed by the hackers can present financial risks for affected consumers for the rest of their lives.

“The Data Breach was a direct result of Defendants’ failure to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect consumers’ private Information,” the Ryan and Garcia state in the lawsuit. “Ticketmaster consumers are in the dark, unaware that their Private Information may be used to effectuate identity theft, phishing scams, plunging credit scores and related cybercrimes.”

The lawsuit presents claims of negligence, negligence per se, breach of fiduciary duty, breach of implied contract, and violation of California consumer privacy and unfair competition laws.

AT&T Data Breach Caused By Same Hackers

The group taking responsibility for the massive Ticketmaster data breach is called ShinyHunters. It is the same group that claimed responsibility for a recently revealed AT&T data breach, which involved the personal identifying information of more than 70 million customers. While that breach likely happened in 2021, AT&T did not admit that it had occurred until this March, leaving millions of customers scrambling to protect themselves from identify fraud after their personal information had already been released on the Dark Web.

Since the revelation, a growing number of AT&T data breach lawsuits have been filed in courts nationwide, both by individuals who actually experienced identity fraud, and class action complaints by concerned customers.

Last week, the U.S. Judicial Panel on Multidistrict Litigation (JPML) heard oral arguments on whether to consolidate AT&T data breach lawsuits before one federal judge for coordinated pretrial proceedings.

If the JPML chooses to consolidate the lawsuits before one judge, pretrial proceedings will be coordinated to avoid duplicative discovery into common issues in the cases, and the court will likely establish a bellwether program where a small group of cases will be prioritized, to help gauge how juries may interpret expert testimony and evidence likely to be used in thousands of trials.