Here’s what happened in the 2024 Ticketmaster breach—and what you can do about it

ICYMI, here’s what happened

In early 2024, Ticketmaster fell victim to a major data breach, which exposed the personal and financial information of millions of users. Ticketmaster informed their customers that they “discovered unauthorized activity on an isolated cloud database hosted by a third-party data services provider.” However, upon further investigation, it was reported that hackers “used compromised Ticketmaster credentials that did not have multi-factor authentication enabled to steal the data from their Snowflake account.” 

This unmitigated access resulted in the theft of millions of customers’ Personally Identifiable Information (PII) and payment card information (PCI), including customer names, emails, phone numbers, and encrypted credit card numbers.

What can you do if you were affected?

Though Ticketmaster is offering affected customers “a free 12-month identity monitoring service with a leading provider,” it’s still a good idea for customers to also take the following steps. 

1. Monitor your financial accounts: Regularly review your bank and credit card statements for any unauthorized transactions. Report any suspicious activity to your financial institution immediately.
2. Place a fraud alert: Consider placing a fraud alert on your credit reports. This will notify creditors to take extra precautions when verifying your identity before issuing credit in your name.
3. Change your passwords: Update your passwords for all online accounts—especially those using the same credentials as your Ticketmaster account. Use strong, unique passwords for each account to enhance security, and store your passwords in a password manager. ‍
4. Set up Two-Factor Authentication (2FA): Add 2FA to your accounts to add an extra layer of security. This ensures that even if your password is compromised, an additional verification step is still required to access your account.

What can organizations do to prevent similar breaches? 

According to Verizon’s 2024 Data Breach Investigations Report, nearly a quarter of data breaches involve stolen credentials. Often these secrets are obtained through social engineering tactics like phishing. However, secret sprawl can also play a part in these sorts of breaches; once a threat actor gains access to an organization’s cloud environment, they can sift around for unencrypted secrets that may be stored in SaaS apps, and then use those secrets to escalate their privileges further. 

No matter the method of attack, here are a few ways organizations can defend against data breaches:

1. Deploy Data Loss Prevention (DLP) software: Organizations can prevent privilege escalation attacks by scanning for and remediating sprawled secrets using automated data leak prevention (DLP) tools like Nightfall AI. By setting up real-time notifications and automated workflows, organizations can quickly delete, redact, rotate, or encrypt secrets as soon as they're shared. This quick time to remediation can reduce the likelihood of a privilege escalation attack. 
2. Conduct regular security audits: Regular security audits and penetration testing can identify and address vulnerabilities in your organization’s security infrastructure. This proactive approach helps prevent potential breaches by strengthening your defenses.
3. Educate employees on security best practices: It’s essential to train employees on security policies, such as using strong passwords, and keeping their passwords encrypted in a password manager. DLP tools can often help with employee education; for instance, Nightfall’s “Human Firewall” feature notifies employees directly when they violate their organization’s security policies, and even empowers employees to remediate their policy violations themselves so that they have more of a stake in their company security. ‍
4. Enforce Role-Based Access Controls (RBAC): According to the “Least Privilege” principle, strict access controls ensure that only authorized personnel can access sensitive information. This reduces the risk of data being accessed or misused by unauthorized individuals.

TL;DR

The Ticketmaster 2024 data breach underscores the critical need for enhanced cybersecurity practices. Affected customers should take immediate action by monitoring their financial accounts, updating passwords, and enabling two-factor authentication to protect their personal information. For organizations, the breach highlights the importance of deploying advanced security tools like Data Loss Prevention (DLP) software, conducting regular security audits, educating employees on security best practices, and enforcing strict access controls. By adopting these proactive measures, both individuals and businesses can fortify their defenses against future breaches.

FAQs

What is the difference between PII and PCI?

PII (Personally Identifiable Information) refers to data that can identify an individual, such as names and addresses, whereas PCI (Payment Card Industry) data refers to payment card information, such as credit card numbers. Both require stringent protection but fall under different regulations, ranging from PCI-DSS to SOC to HIPAA and beyond. 

How can I discover PII data in my organization?

Data Loss Prevention (DLP) software can help identify and classify sensitive information within your organization. AI-powered software like Nightfall not only helps to prevent secret sprawl, but also to defend company and customer data from breaches and noncompliance.

What is secret sprawl?

Secret sprawl refers to the unintentional distribution of sensitive information, such as credentials and passwords, across various platforms like GitHub, Slack, and Microsoft Teams. This exposure can lead to significant security risks, including privilege escalation and lateral movement within a network. Detecting and remediating these secrets in real time is crucial for preventing unauthorized access and protecting high-risk systems such as AWS, GCP, or Azure.

What are privilege escalation attacks?

Privilege escalation attacks happen when a threat actor exploits vulnerabilities to gain higher-level access within a system. This unauthorized access allows them to move laterally across the network, often leading to more extensive breaches and damage. In order to mitigate these attacks, organizations must implement strict access controls, conduct regular security audits, and deploy Data Loss Prevention (DLP) tools to detect and remediate exposed credentials.

What are the best Data Loss Prevention (DLP) tools?

The best DLP tools vary based on organizational needs but generally include features like real-time monitoring, data classification, and robust reporting. Check out our blog to see how Nightfall’s AI-native DLP solution stacks up against legacy DLP solutions like Microsoft Purview, Google Cloud DLP, Forcepoint, and more.