Ticketfly, an event ticketing distribution service, had its website defaced by an attacker in May 2018 after the company did not respond to a ransom demand. The attacker had discovered a vulnerability and sought payment in exchange for disclosing it. When Ticketfly did not reply, the attacker posted the stolen data to a publicly accessible location and took the site offline. The breach exposed records tied to over 26.2 million accounts. The leaked data included email addresses, full names, phone numbers, and physical home addresses. No passwords appeared in the publicly posted files, but Ticketfly later acknowledged that hashed password values may also have been accessed during the intrusion. For affected individuals, the combination of contact details and home addresses creates real exposure: the data is enough to enable phishing attempts, account takeover efforts, and targeted scams built around event attendance and purchasing history. No widely reported regulatory enforcement action followed the breach, though Ticketfly issued a public incident update disclosing the potential password exposure. Affected individuals face ongoing risk from phishing and impersonation, particularly messages mimicking ticketing platforms or live event brands. Those who reused passwords across services should treat any accounts sharing Ticketfly credentials as compromised.

Event-ticketing platforms collect buyer identity, contact details, payment-adjacent records, order history, venue interactions, and attendance-linked data across ticket-commerce workflows.

Defunct