Ticketfly Class Action Says Data Breach Compromised 26M User Accounts

Ticketfly faces a class action lawsuit alleging that the concert ticketing service failed to protect their consumers’ information, resulting in a massive data breach this summer.

Plaintiff Shanice Kloss further claims that the concert ticket company, and its parent company Eventbrite Inc., failed to inform her and more than 26 million other users who were affected by the data breach that their information may have been compromised.

“Eventbrite’s lax security procedures allowed hackers to obtain access to Plaintiff’s and other consumers’ [personal identifying information],” the Ticketfly data breach class action lawsuit claims. “This [personal identifying information] should have been secured by adequate levels of protection and should not have been susceptible to unauthorized access via the ransomware attack employed in the subject data breach.”

Ticketfly is a concert ticket website utilized by music venues and events to sell tickets. In May, hackers compromised the Ticketfly system and gained access to more than 26 million users’ names, phone number, addresses, emails, and passwords, according to the Ticketfly class action lawsuit.

Kloss argues that Ticketfly did not appropriately handle the data breach by putting up a “passive” support page and releasing only a single tweet in June regarding the issue. Kloss says that she only learned about the data breach in September, so her information was unprotected and unmonitored for months.

“Defendant not only failed to protect plaintiff’s and other customers’ [personal identifying information], but also failed to inform them of the data breach in a reasonable manner and without undue delay,” the Ticketfly data breach class action lawsuit states.

The Ticketfly class action argues that, had Kloss and other users known about the breach sooner, they would have been able to monitor their information for any sign of misuse and fraud.

Kloss also claims that hackers told Eventbrite of the weakness in their cybersecurity before the breach, so the company knew that an attack was coming. Despite allegedly being aware of the weakness in their cybersecurity, the company did nothing to increase their protections or prevent an attack.

“Nonetheless, Eventbrite failed to take reasonable measures following such communication to either discover and mitigate the vulnerability or follow up with the source of the communication,” the Ticketfly class action lawsuit claims.

The Ticketfly data breach class action claims that the company’s actions are in violation of Illinois consumer protection laws and constitute breach of contract and negligence.

Kloss seeks to represent a Class of users whose information was obtained through the data breach as well as an Illinois subclass of the same users in Illinois protected under additional state laws.

The Ticketfly data breach class action lawsuit seeks damages and court orders directing the company to improve their cybersecurity and provide “fraud monitoring and mitigation services” to the users affected by the breach.

Kloss is represented by Jad Sheikali and William Kingston of McGuire Law PC.

The Ticketfly Data Breach Class Action Lawsuit is Kloss v. Eventbrite Inc., Case No. 2018-CH-12352, in Cook County Circuit Court, Illinois.