The 2018 Ticketfly Data Breach: What Happened and What Was Leaked?

In early May 2018, Ticketfly—a well-known ticket distribution platform serving music venues and event promoters—suffered a major data breach that impacted millions of users. The incident came to light when an attacker defaced the Ticketfly website, making headlines and prompting an immediate shutdown for investigation. Shortly after, it was revealed that the breach had exposed over 26 million unique customer records. The leaked data, which surfaced online, included users’ names, emails, addresses, and phone numbers. Although passwords weren’t present in the publicly available files, Ticketfly later confirmed that hashed passwords could also have been accessed during the breach. This incident raised concerns across the live event industry, given how much personal information had been compromised.

How Did the Ticketfly Breach Happen?

The breach began on May 30, 2018, when an attacker exploited a vulnerability on Ticketfly’s website to deface its homepage and gain access to its backend databases. As part of the attack, the intruder posted a ransom demand, but when that went unanswered, the hacker published the stolen data online for anyone to access. The breach was highly public due to the visible website defacement and quick spread of information about leaked customer details.

What Data Was Exposed in the Ticketfly Breach?

The information compromised in the Ticketfly breach included a range of personally identifiable details. For the majority of affected users, the breach exposed:

• First and last names
• Email addresses
• Street addresses (including any apartment or suite numbers)
• City, state, and zip code
• Phone numbers

While password data wasn’t posted online, Ticketfly acknowledged that hashed password credentials might have also been taken by the attacker. This meant ticket buyers, event creators, and partners all had personal info laid bare.

How Many People Were Impacted?

Ticketfly estimated that more than 26 million unique records were compromised. However, the underlying leak contained just over 6.1 million unique user accounts, each containing at least a name and email address, along with most users’ addresses and phone numbers. Aside from the core user base, the breach also covered event organizers and venues that used Ticketfly’s platform for sales and promotions.

The Timeline of the Ticketfly Breach

The attack became public knowledge on May 30, 2018, when the site was defaced and quickly taken offline. Data was subsequently leaked online, escalating the situation and exposing millions of records. Ticketfly’s response included working with cybersecurity firms and informing affected users once the scope had been established. By June, details of what types of data were leaked and who had been affected were confirmed, tracing the main breach window to late May 2018.

Frequently Asked Questions about the Ticketfly Data Breach

What happened during the Ticketfly data breach?

In May 2018, an attacker gained access to Ticketfly’s systems, defaced the website, and leaked personal information of millions of users, including names, contact details, and possibly hashed passwords.

How many users were affected by the Ticketfly breach?

More than 26 million unique records were exposed, with over 6.1 million unique user accounts confirmed as impacted by the breach.

What personal data was leaked in the Ticketfly breach?

The exposed data included names, email addresses, physical mailing addresses, city, state, zip code, and phone numbers. Hashed password data might also have been accessed.

Who was behind the Ticketfly data breach?

The attacker behind the breach has not been officially identified. The incident became public when the attacker defaced Ticketfly’s website and published stolen data after ransom demands were not met.

When did the Ticketfly data breach occur?

The breach was first detected on May 30, 2018, with evidence pointing to an attack window in late May 2018.

How can I check if I'm in the Ticketfly breach?

You can check if your information was part of the Ticketfly breach by utilizing the DeHashed search engine.