Ticketmaster Data Breach: What Was Exposed and What to Do
In 2024, data from a third-party cloud database used by Ticketmaster was stolen and offered for sale. Here is what was involved and what to do.
By Siddharth ShankarUpdated October 18, 2026Live Nation said that on May 20, 2024 it found unauthorized activity in a third-party cloud database holding mainly Ticketmaster data, and that a criminal offered the data for sale on May 27. Ticketmaster says the data involved included email addresses, phone numbers, encrypted card information and other details for some customers who bought tickets for events in the US, Canada and Mexico. Watch your card statements, beware of breach-themed scams and accept the free monitoring if you were notified.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Ticketmaster sells tickets for a huge number of events, so this incident touched many music and sports fans. It was one of several 2024 breaches linked to data stored with third-party cloud providers.
What happened
In a filing with the US Securities and Exchange Commission, Ticketmaster’s parent company Live Nation said that on May 20, 2024 it identified unauthorized activity in a third-party cloud database containing company data, mainly from Ticketmaster. On May 27, 2024, a criminal offered what it claimed was the company’s user data for sale on the dark web. Live Nation said it was working with law enforcement and notifying regulators and users.
What data was involved
Ticketmaster’s data security incident page says the information may have included:
- Email address
- Phone number
- Encrypted credit card information
- Other personal information customers gave Ticketmaster
It says the affected customers were some of those who bought tickets for events in the US, Canada and/or Mexico. Ticketmaster says customer accounts were not affected and passwords do not need to be reset.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Who was notified
Ticketmaster says it notified affected customers by email or first-class mail. If you were not contacted, it says it does not believe your sensitive information was involved. Notified customers were offered 12 months of free credit or identity monitoring.
What to do now
1Check your card statements
Look for charges you do not recognise and contact your bank or card issuer straight away if you see any.
2Enrol in the free monitoring if notified
Use the instructions in the official letter or email, not a link from an unexpected message.
3Be wary of ticket and refund scams
Fans are a common target for fake refund emails and fake ticket offers. Do not click links in unexpected messages that mention the breach. See how to tell if a breach notice is real.
4Use a strong, unique password
Ticketmaster recommends a strong, unique password for your account. If you reused it anywhere, change it there too. See why one breach puts other accounts at risk.
5Check your email against breaches
Run the free check on this page to see which other breaches include your email.
Why breach notices are a target for scammers
After a widely reported breach, criminals send fake notices that look like the real one. They often ask you to click a link to claim compensation, verify your card or enrol in monitoring. A real notice will not ask for your full card number or password. When in doubt, go to the company’s website yourself rather than using the link in the message.
If your card was used
Contact your bank or card issuer immediately. Most cards can be frozen in the app while you investigate. Ask for a replacement card and check any subscriptions linked to the old number.
Did it affect fans outside North America?
Ticketmaster’s incident page describes the affected customers as some of those who bought tickets for events in the US, Canada and Mexico. If you bought tickets elsewhere and receive a message claiming you were affected, check it carefully against the official page before acting.
The bigger lesson
Your data is often stored with providers you have never heard of. You cannot control that, but you can limit the damage: use unique passwords, turn on two-factor authentication, keep card alerts on and share only the details a service really needs. Read what a data breach is and how it happens.
Sources
- Live Nation Entertainment Form 8-K (SEC, May 2024) (May 20 discovery, third-party cloud database, May 27 dark web offer)
- Ticketmaster Help: Data Security Incident (data involved, US/Canada/Mexico, accounts not affected, notification, 12 months monitoring)
Frequently asked questions
Was my Ticketmaster password exposed?
Ticketmaster says customer accounts were not affected and passwords do not need to be reset. Use a strong, unique password anyway.
Were card numbers stolen?
Ticketmaster says encrypted credit card information may have been involved. Check your statements and tell your bank about anything suspicious.
How do I know if I was affected?
Ticketmaster says it notified affected customers by email or post. If you were not contacted, it does not believe your sensitive information was involved.
Is there free credit monitoring?
Yes. Notified customers were offered 12 months of free credit or identity monitoring.
Which customers were affected?
Some customers who bought tickets for events in the US, Canada and/or Mexico, according to Ticketmaster.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.