Ticket to Cash data leak exposes over 520,000 records
Learn More
Cybersecurity researcher Jeremiah Fowler has discovered an unprotected database containing 520,054 records belonging to Ticket to Cash, an online ticket resale platform. The database name indicated it contained customer inventory files in PDF, JPG, PNG, and JSON formats.
Exposed documents included:
- Thousands of concert and live event tickets
- Proof of ticket transfers
- User-submitted screenshots of receipts
- Partial credit card numbers
- Full names
- Email addresses
- Home addresses
It's unclear if the database was owned and managed directly by Ticket to Cash or by a third-party contractor. There is no details how long the database had been exposed before its discovery is also unknown.
Fowler submitted responsible disclosure notice was sent to TicketToCash.com but did not receive an initial reply. The database remained publicly accessible for several days. During the four days between the first and second disclosure notices, over 2,000 additional files were added to the exposed database.
Access to the database was finally restricted only after a second notice was sent.
No other information was disclosed by Ticker to Cash.
