Ticketmaster Brazil confirms customer data exposure via third-party analytics tool, ANPD notified
Ticketmaster confirmed a security incident that exposed personal data of customers in Brazil who bought tickets in 2025. The company notified affected users by email and reported the case to the Brazilian data protection authority (ANPD). According to the company, the incident involved a third-party data analytics tool. The investigation, supported by external cybersecurity experts, was concluded in September 2026. Ticketmaster did not disclose how many people were affected.
Technical Details
- Exposed data varies by what each customer provided at purchase: age range or date of birth, CPF or another ID document, and purchase information such as payment method and the last four digits of the credit card.
- Ticketmaster states that full card numbers, bank account data and account login credentials were not involved.
- The ticket sales platform and customer account systems were reportedly not affected.
- The article does not name a threat actor, the third-party vendor, the intrusion method or any IOCs.
Remediation
- Ticketmaster says it took immediate containment measures, is reinforcing its data security controls and gave affected customers guidance on protecting their personal information.
- Customers should be alert to suspicious communications that may abuse the exposed data. Official channels do not request passwords, payment methods or other sensitive information without prior notice.
Linha do tempo
-
Ticketmaster Brazil confirms customer data exposure via third-party analytics tool, ANPD notified
ler a análise desta fonte ocultar
Ticketmaster confirmed a security incident that exposed personal data of customers in Brazil who bought tickets in 2025. The company notified affected users by email and reported the case to the Brazilian data protection authority (ANPD). According to the company, the incident involved a third-party data analytics tool. The investigation, supported by external cybersecurity experts, was concluded in September 2026. Ticketmaster did not disclose how many people were affected.
Technical Details
- Exposed data varies by what each customer provided at purchase: age range or date of birth, CPF or another ID document, and purchase information such as payment method and the last four digits of the credit card.
- Ticketmaster states that full card numbers, bank account data and account login credentials were not involved.
- The ticket sales platform and customer account systems were reportedly not affected.
- The article does not name a threat actor, the third-party vendor, the intrusion method or any IOCs.
Remediation
- Ticketmaster says it took immediate containment measures, is reinforcing its data security controls and gave affected customers guidance on protecting their personal information.
- Customers should be alert to suspicious communications that may abuse the exposed data. Official channels do not request passwords, payment methods or other sensitive information without prior notice.