Ticketmaster Faces Brazil Data Breach Questions

Questions about data protection and regulatory compliance are mounting for Ticketmaster after the company disclosed a security incident affecting Brazilian customers who purchased tickets during 2025. The Live Nation-owned ticketing platform said an external analytics tool was involved, while the number of affected individuals, the precise exposure timeline, and the extent of the compromised records remain undisclosed.

According to TicketNews, the potentially exposed information included customers' names, contact details, residential location information, dates of birth or age ranges, government identification records, and ticket-purchase details. Some records may also have contained Brazil's CPF taxpayer identification numbers, payment methods, and the final four digits of credit cards.

Ticketmaster attributed the incident to a temporary vulnerability in a third-party data analytics tool rather than its primary ticketing infrastructure. The company said it took immediate steps to contain the issue and began an investigation with external cybersecurity specialists.

The company also said its core ticketing and fan account systems remained unaffected.

"The ticket sales platform and fan account systems were not affected," Ticketmaster said in a statement provided to Brazilian media, according to TicketNews.

Ticketmaster maintained that account passwords, complete credit card numbers, and bank account numbers were not compromised. The company has not disclosed the number of affected customers, identified the external analytics provider, or established publicly whether people outside Brazil were affected.

According to TicketNews, Ticketmaster began notifying affected customers on October 14. Brazilian technology publication Canaltech reported that the company's investigation, conducted with external cybersecurity specialists, had concluded in September 2026. The company has not publicly clarified when it first discovered the incident or determined that personal information had been exposed.

Those unresolved dates are relevant to Brazil's data protection requirements. Under Resolution CD/ANPD No. 15/2024, organizations generally must notify the national data protection regulator, the ANPD, and affected individuals within three business days of becoming aware of a qualifying personal data incident involving potential risk or significant harm.

The reported interval between the investigation's conclusion and customer notifications does not independently establish a regulatory violation. Assessing compliance requires additional information about when Ticketmaster became aware of the exposure and when it submitted the required notifications.

Brazilian technology publication Olhar Digital reported on October 15 that Ticketmaster had confirmed notifying the ANPD, although the company did not disclose the notification date. The regulator acknowledged an inquiry from TicketNews and referred it to its technical department.

The ANPD confirmed that it had received the media organization's inquiry but did not announce a formal investigation or identify any compliance concerns.

"We received your inquiry and forwarded it to the technical department," the ANPD's communications office said in an email response translated from Portuguese, according to TicketNews.

TicketNews also sought information from Ticketmaster and Live Nation about the number of affected customers, the third-party provider, potential international exposure, and possible connections to other cybersecurity incidents. Neither company had provided substantive answers to those questions at publication.

The Brazilian disclosure follows a separate incident that Live Nation reported to the Vermont Attorney General's Office on October 1. That incident involved Social Security numbers, government identification records, and health information. Three proposed class action lawsuits against Live Nation were filed in federal court in California on October 6 and 7, alleging inadequate protection of sensitive personal information.

Live Nation characterized the US incident as limited in scope, involving a small number of individuals without disrupting operations. Two plaintiffs identified themselves as former employees, raising questions about whether the exposed information primarily involved employment records. The company has not publicly established a connection between that incident and the Brazilian breach.

The Brazilian incident also follows Ticketmaster's 2024 data breach involving customer information stored in a third-party Snowflake cloud database. Live Nation previously confirmed unauthorized access to Ticketmaster information in that database but did not independently verify all claims made by hackers about the number of records stolen.