Canada Investigates Ticketmaster Over Breach

The Privacy Commissioner of Canada has announced that it has launched an investigation into the cybersecurity incident that impacted Ticketmaster.

The incident itself was discovered in May by Ticketmaster and its parent company, Live Nation, in which an “unauthorized party” was able to access customer information between April 2 and May 18. The data was stored in a cloud infrastructure hosted by a third party.

Ticketmaster informed its customers in July of the breach, saying that their data, including their “name, basic contact information, and payment card information such as encrypted credit or debit card numbers and expiration dates,” may have been exposed.

Ticketmaster also published a dedicated page to provide information to all its users on the breach and advised that those customers who didn’t receive an email or written communication from Ticketmaster should consider their data unaffected.

The investigation in Canada focused on whether Ticketmaster complied with the federal privacy law called the Personal Information Protection and Electronic Documents Act (PIPEDA). The investigation aims to determine if Ticketmaster’s practices were sufficient under the law to safeguard user data and whether Ticketmaster fully complied with the law when notifying users of the breach.

Privacy Commissioner of Canada Philippe Dufresne says, “Ticketmaster holds the personal information of millions of Canadians. The investigation will allow us to understand why this cyber incident happened and what must be done to address this situation and prevent it from happening again.”

Ticketmaster has said, “We take data protection very seriously and have been working with the relevant authorities, including law enforcement, as well as credit card companies and banks.”

At the time of the incident, hacking group ShinyHunters claimed they had obtained data from over 500 million Ticketmaster users and demanded $500,000 to return the data. Those investigating the incident have not confirmed this claim.