cloudThing logo in white
Menu open icon
tel: +44 (0) 121 393 4700
Menu closed icon


Generally useful pages


We know loads about this stuff

What we do

The Building Blocks for cloudThing Magic

ICO Fines Ticketmaster £1.25 Million In GDPR Breach

Mon Nov 23 2020

The ICO fine to Ticketmaster came after they were found to be not protecting their customers personal data securely enough.

The ICO (Information Commissioners Office) has found that Ticketmaster has failed to put in enough cyber security measures to effectively prevent cyber attacks on a chat-bot they’d installed on their online payment page.  The ICO deemed that failure a clear breach of GDPR (General Data Protection Regulations) and so handed down a fine of £1.25 million.


The data breach, which included individuals names, card numbers, expiry dates and CVV numbers could have affected over 9.4 million of Ticketmaster’s customers across Europe, with 1.5 million here in the UK.

Due to this breach, investigators had found that over 60,000 payment cards belonging to Barclays Bank customers had experienced fraudulent activity.

Monzo Bank replaced 6,000 cards after learning of the breach to prevent fraudulent activity.


Summarising it’s decision, the ICO said Tickmaster had failed to:


  • Assess the risks of using a chat-bot on its payment page
  • Identify and implement appropriate security measures to negate the risks
  • Identify the source of suggested fraudulent activity in a timely manner
open quote mark

When customers handed over their personal details, they expected Ticketmaster to look after them. But they did not. Ticketmaster should have done more to reduce the risk of a cyber-attack. Its failure to do so meant that millions of people in the UK and Europe were exposed to potential fraud. The £1.25milllion fine we’ve issued today will send a message to other organisations that looking after their customers’ personal details safely should be at the top of their agenda.

James Dipple-Johnstone - Deputy Commissioner, ICO

close quote mark

The Ticketmaster data breach dates back to Feb of 2018 when Monzo Bank customers began reporting suspicious or fraudulent transactions. The Commonwealth Bank of Australia, Barclaycard, Mastercard and American Express all then followed, reporting suggestions of fraud to Ticketmaster. However, Ticketmaster failed to identify any problems with their systems or processes.

It took Ticketmaster a further nine weeks after the warnings realise something was going on.


After stepping in to investigate, the ICO found that it was the decision to introduce a third-party chatbot on their payment pages that had allowed an attacker(s) to access their customers private data.


The chat-bot was removed from Ticketmaster’s website on 23rd June 2018.

Not Quite ready To Get Back To Work Just Yet?




Contact Us



Company Name


Email Address


Telephone Number

Is there anything else you'd like us to know?

© cloudThing 2021

Mon Nov 23 2020

© 2020 Copyright cloudThing ltd. All rights reserved. Company registered in England & Wales no. 7510381, VAT no. 152340739