Consumers who purchased event passes through Ticketmaster Brasil began receiving electronic alerts on Wednesday (14) regarding a cybersecurity breach that compromised personal records and transaction histories. The exposure affected individuals who bought tickets on the platform throughout the calendar year prior to the notification. According to the ticketing operator, the security lapse originated in a temporary vulnerability inside an external data analytics tool rather than within the primary sales infrastructure.

Company officials stated that the compromised analytics environment operates separately from the core ticketing system. “Ticketmaster Brasil confirms that it recently notified fans affected by a security incident involving a data analysis tool provided by third parties. Immediate measures were adopted to contain the incident and an investigation was launched with the support of external cybersecurity experts,” the company stated in an official press note.

Personal identification and payment records compromised in the third-party tool

The exact scope of the exposed information depends on the specific details each buyer entered at the time of checkout. Ticketmaster Brasil maintains that its primary servers did not suffer a direct intrusion during the event and that login credentials remain safe. “The ticket sales platform and fan account systems were not affected, and the incident did not involve full credit card numbers, bank account numbers, or access credentials for Ticketmaster accounts,” the company declared in its official statement.

Registration and financial details potentially accessed during the breach of the external analytics tool include the following records:

• Full name, gender, and age bracket or date of birth;
• Individual Taxpayer Registry number (CPF, the Brazilian federal tax identification document) or another submitted identity document number;
• Contact telephone number and electronic mail address;
• Residential address containing neighborhood, city, and state;
• Payment method used in the transaction along with the last 4 digits of the credit card.

Federal data regulator notification and investigation timeline

In the messages distributed to consumers starting on October 14, 2026, the ticketing service reported that its internal inquiry, conducted alongside external cybersecurity specialists, concluded in September 2026. On Thursday (15), the enterprise confirmed that it formally notified the National Data Protection Authority (ANPD, the Brazilian federal agency responsible for enforcing personal data legislation). Under Resolution CD/ANPD No. 15/2024, which governs security failure disclosures in the country, organizations must notify both the federal autarchy and affected individuals within a general deadline of three business days after becoming aware of events that may cause relevant risk or damage, with rules allowing preliminary filings that can be supplemented later.

Contacted to clarify the exact timeline of the case and whether an administrative inspection would be opened to evaluate the gap between the conclusion of the internal probe in September and the consumer alerts in October, the ANPD press office reported on Monday (19) that the inquiry had been forwarded to its technical division. “We received your request and forwarded it to the technical area. As soon as we receive a response, we will get back in touch,” the regulatory agency stated in an official note.

See also: Rockstar Games faces 200 GB data breach on Grand Theft Auto VI

Neither Ticketmaster Brasil nor the federal regulator has disclosed the total number of customers affected by the leak in the country. Several technical details also remain undisclosed, including the corporate name of the third-party vendor responsible for the analytics tool, the exact date the intrusion took place, the moment the vulnerability was discovered, and the precise day the Brazilian authority received the formal filing. Furthermore, the company has not clarified whether the technological breach affected operations outside Brazilian territory or whether local buyers will be offered complimentary credit monitoring services.

Security guidance and official support channels for ticket buyers

Cybersecurity specialists warn that the combination of event purchase histories and personal identification numbers can facilitate targeted phishing schemes, in which fraudulent messages reference real concerts or fake ticket refunds to deceive victims. “The company provided affected fans with guidance to help them protect their personal information and maintains the reinforcement of its data security measures,” Ticketmaster Brasil said in its statement.

Customers who acquired tickets on the platform during the affected period are advised to check the inbox of the email account linked to their registration, though having made a purchase does not automatically mean a user profile was compromised. The company urged buyers to remain wary of unsolicited communications, emphasizing that its official support teams never request account passwords or financial details. To address specific inquiries regarding the episode, the ticketing operator established a dedicated email address for the data incident alongside its general privacy communication channel in the country.

Check out: Rockstar Games faces 200 GB data breach ahead of GTA 6 debut

Commercial expansion in São Paulo and Live Nation security cases

In the domestic market, confirmation of the data exposure comes shortly after new commercial agreements signed by the platform, which has Saumil Mehta as its global president. On October 2, 2026, Ticketmaster formalized a contract to take over ticket sales and the fan membership program for São Paulo Futebol Clube, a major Brazilian professional soccer club, starting on January 1, 2027. Because the third-party vulnerability affected earlier transaction records, there is no indication that data tied to the soccer club partnership was compromised. Prior to this disclosure, in September 2026, posts on underground forums advertised the alleged sale of buyer records from the The Town music festival in Latin America, but security analysts could not verify which organization held the offered database or confirm any direct connection to the incident communicated in October.

On the international front, Live Nation Entertainment, the parent company of Ticketmaster, has faced separate cybersecurity incidents with no established link to the Brazilian operation. On October 1, 2026, the parent corporation notified the Office of the Attorney General of Vermont in the United States regarding an unrelated breach that exposed Social Security Numbers (SSN, the U.S. federal tax and social insurance identification record), official identity documents, and medical files. That disclosure prompted the filing of at least three class-action lawsuits in the U.S. District Court for the Central District of California on October 6 and October 7, 2026, brought by plaintiffs Amanda Fraga, Toby Gosman, and Isiah Ramos.

Earlier, on May 20, 2024, Live Nation identified unauthorized activity within a cloud database operated by the third-party vendor Snowflake, an episode in which the hacking group ShinyHunters claimed to have obtained records belonging to approximately 560 million Ticketmaster customers worldwide. In connection with that 2024 cloud campaign, 26-year-old Canadian national Connor Riley Moucka, a resident of Kitchener, Ontario, pleaded guilty in U.S. federal court in Washington state on August 5, 2026, to computer fraud, wire fraud, aggravated identity theft, and conspiracy after compromising more than 165 organizations. Moucka faces up to 32 years in prison at his sentencing hearing scheduled for Tuesday, October 27, 2026.