Cybersecurity researcher Jeremiah Fowler recognized and reported a non-password-protected database related to a platform for occasion ticket resale. The platform in query is Ticket to Money, a web-based ticket resale service that enables customers to checklist and sell tickets for live events.
In complete, there have been 520,054 data uncovered. Fowler despatched a disclosure discover to the group however obtained no response. The database remained open for 4 days, so Fowler despatched a second discover. Solely then was the database restricted from public entry. By then, greater than 2,000 extra information had been added to the formerly-exposed database earlier than it was restricted.
Presently, it’s unknown if Ticket to Money owns and manages the database director or if that is accomplished by a third-party contractor. It’s also unknown how lengthy this database was uncovered and if any malicious actors accessed it earlier than Fowler’s discovery.
Uncovered paperwork embody, however will not be restricted to:
- Stay occasion tickets
- Receipt screenshots
- Proof of ticket transfers
In these paperwork, personally identifiable info (PII) could possibly be discovered, reminiscent of full names, e-mail addresses, house addresses, and partial bank card numbers. If uncovered, this info may doubtlessly go away people susceptible to phishing attacks, identification theft, or monetary fraud. Moreover, tickets could possibly be offered a number of occasions, stolen, or used as counterfeiting templates.
