The ICO (Information Commissioners Office) has found that Ticketmaster has failed to put in enough cyber security measures to effectively prevent cyber attacks on a chat-bot they’d installed on their online payment page. The ICO deemed that failure a clear breach of GDPR (General Data Protection Regulations) and so handed down a fine of £1.25 million.

The data breach, which included individuals names, card numbers, expiry dates and CVV numbers could have affected over 9.4 million of Ticketmaster’s customers across Europe, with 1.5 million here in the UK.

Due to this breach, investigators had found that over 60,000 payment cards belonging to Barclays Bank customers had experienced fraudulent activity.

Monzo Bank replaced 6,000 cards after learning of the breach to prevent fraudulent activity.

Summarising it’s decision, the ICO said Tickmaster had failed to:

Assess the risks of using a chat-bot on its payment page
Identify and implement appropriate security measures to negate the risks
Identify the source of suggested fraudulent activity in a timely manner

When customers handed over their personal details, they expected Ticketmaster to look after them. But they did not. Ticketmaster should have done more to reduce the risk of a cyber-attack. Its failure to do so meant that millions of people in the UK and Europe were exposed to potential fraud. The £1.25milllion fine we’ve issued today will send a message to other organisations that looking after their customers’ personal details safely should be at the top of their agenda.

James Dipple-Johnstone - Deputy Commissioner, ICO

The Ticketmaster data breach dates back to Feb of 2018 when Monzo Bank customers began reporting suspicious or fraudulent transactions. The Commonwealth Bank of Australia, Barclaycard, Mastercard and American Express all then followed, reporting suggestions of fraud to Ticketmaster. However, Ticketmaster failed to identify any problems with their systems or processes.

It took Ticketmaster a further nine weeks after the warnings realise something was going on.

After stepping in to investigate, the ICO found that it was the decision to introduce a third-party chatbot on their payment pages that had allowed an attacker(s) to access their customers private data.

The chat-bot was removed from Ticketmaster’s website on 23rd June 2018.