More than 500 million Ticketmaster customers have had their information stolen in a massive data breach, the ticket seller’s parent company confirmed in a federal filing with the U.S. Securities and Exchange Commission.
Live Nation Entertainment said in the filing on Friday that it had “identified unauthorized activity within a third-party cloud based environment,” The New York Times reported.
The data taken was identifying information, including credit card numbers, emails, addresses, phone numbers and ticket purchases. Passwords do not appear to have been compromised, but cyber experts suggest changing them anyway.
[ Spotify raising its prices again ]
The company believes a hacking group called ShinyHunters initiated the attack with the intent of getting personal information and selling it, asking for $500,000.
The “unauthorized activity” was discovered on May 20, but it is unclear when the hack happened, the newspaper reported.
It was focused on Ticketmaster, Variety reported.
Live Nation said it was “working to mitigate risk to our users,” The Associated Press reported.
But the company said it doesn’t think that the hack had “a material impact on our overall business operations or on our financial condition or results of operations” and it expects that it won’t have an impact in the future.
“We continue to evaluate the risks and our remediation efforts are ongoing,” Live Nation said, according to Variety.
News of the hack came just over a week after the Justice Department sued Live Nation, claiming antitrust issues.
[ DOJ sues Ticketmaster owner over claims of monopoly; raising ticket fees, prices ]
This isn’t the first well-known brand that ShinyHunters has targeted. It has also breached Microsoft, AT&T and other companies worldwide.
The AT&T breach compromised about 7.6 million current customers and an additional 65.4 million former account holders, the company said in March.
The Department of Justice earlier announced that a member of ShinyHunters was convicted of conspiracy to commit wire fraud and aggravated identity theft. Sebastien Raoult, a 22-year-old French citizen, was sentenced in January to three years in prison and ordered to pay more than $5 million in restitution, The New York Times reported.