Ticketmaster Data breach alleged to be part of a wider fraud

Ticketmaster’s data breach that affected thousands of customers last month was reportedly part of a larger credit card skimming scheme.

Cybersecurity firm RiskIQ has this week released a report revealing that the hack did not appear to be an isolated incident with the international ticket seller. Rather, a hacking group called Magecart had targeted around 800 e-commerce sites.

Following the breach, Ticketmaster admitted it had been hacked by “malicious software” on third-party customer support product Inbenta Technologies, which works with the ticketing giant.

The skimming system takes the data from people when they enter credit card information onto a website.

In the report, Inside and Beyond Ticketmaster: The Many Breaches of Magecart, RiskIQ researchers Yonathan Klijnsma and Jordan Herman wrote “since 2016, RiskIQ has reported on the rise of card skimmers of the digital variety operated by the threat group Magecart that use scripts injected into websites to steal data that’s entered into online payment forms on e-commerce sites.

“Hackers placed one of these digital skimmers on Ticketmaster websites through the compromise of a third-party functionality supplier known as Inbenta.”

RiskIQ said it identified some 100 well-known brands as other victims of Magecart’s scheme, but did not reveal their identities.

The researchers said it appeared that Magecart was becoming more sophisticated in its techniques, adding “even more disturbing, the Ticketmaster breach demonstrates that the Magecart actors are continuing to refine their techniques and get better at target selection.

“Previously, they compromised individual websites and added new Javascript or links to remote Javascript files, but they seem to have gotten smarter—rather than go after websites, they’ve figured out that it’s easier to compromise third-party suppliers of scripts and add their skimmer.”

In some cases, adding the credit card skimmer system gave the group access to some 10,000 credit card numbers almost immediately.

Click here to view RiskIQ's report Inside and Beyond Ticketmaster: The Many Breaches of Magecart.

28th June 2018 - AUSTRALIAN TICKET BUYERS CAUGHT IN TICKETMASTER DATA BREACH

16th March 2018 - MAN ARRESTED OVER SALES OF FAKE TICKETS FOR ED SHEERAN BRISBANE CONCERTS

10th March 2018 - ANZ STADIUM WARNS FANS TO BEWARE OF UNAUTHORISED ED SHEERAN TICKET SALES

8th March 2018 - GUDINSKI: ‘PROMOTERS AREN’T THE BAD GUYS’ IN ED SHEERAN TICKET SCALPING DEBATE

2nd March 2018 - LIVE NATION REGISTERS RECORD REVENUES THROUGH 2017

26th January 2018 - RECORD BREAKING YEAR FOR GLOBAL CONCERT BUSINESS

23rd January 2018 - AUSTRALIAN OPEN FANS TURNED AWAY AFTER BUYING RESALE TICKETS

23rd November 2017 - GOOGLE UPDATES ADWORDS POLICY TO RESTRICT ONLINE TICKET SCALPERS

17th November 2017 - AUSTRALIAN GOVERNMENT BEGINS TICKET SCALPING CONSULTATION

12th June 2017 - ARTS AND ENTERTAINMENT INDUSTRY FIGURES ACKNOWLEDGED IN QUEEN’S BIRTHDAY HONOURS