What happened
In mid-2024 Ticketmaster disclosed a breach of a third-party cloud database (part of the wider Snowflake-related campaign that hit many companies) [sa-tm]. According to Ticketmaster’s notification to customers, the database was accessed between 2 April and 18 May 2024, and exposed information included names, contact details and encrypted card numbers with expiry dates [cbc-tm]. A threat actor (ShinyHunters) claimed to hold data on 560 million customers; this figure was not confirmed by Ticketmaster [sa-tm]. ID Support NSW said the Department of Home Affairs was working with Ticketmaster to understand the impact on affected Australians, and that payment information was not believed to be affected [nswgov-tm]. Ticketmaster’s own incident page says the database contained limited personal information of some customers who bought tickets to events in North America (U.S., Canada and/or Mexico) [ticketmaster] — so Australians affected would be those who bought tickets to North American events. The number of Australian individuals affected was not officially quantified and is not estimated here.
Timeline
- 2024-04-02 to 2024-05-18 — Unauthorised access to a third-party cloud database, per Ticketmaster’s notification [cbc-tm].
- 2024-06 — Ticketmaster confirmed the breach [sa-tm]; ID Support NSW published guidance for affected Australians [nswgov-tm].
- 2024-07 — Ticketmaster notified customers that card information was affected [cbc-tm].
Current status
Disclosed; ID Support NSW published guidance for affected Australians [nswgov-tm]. No regulator notification has been confirmed in the cited sources. Figures are as reported.
Why it matters
A marquee example of the 2024 Snowflake campaign — a breach reached through a shared cloud platform, not Ticketmaster’s own core systems.