Another week, another high-profile data breach, but this one can be filed under “Missed Opportunity.” The site in question is “TicketFly,” which is a web-based event ticket sales website owned by a company called Eventbrite. The TicketFly website was down since May 31st, and the normal homepage had been replaced by an image of Guy Fawkes with the message “Your Security Down I’m Not Sorry.”
The page formerly contained links that pointed to compromised customer information, but those have subsequently been removed by the company, which is still scrambling to recover.
Unfortunately, TicketFly was given every opportunity to avoid the incident altogether. The hacker responsible for taking the site down goes by the handle “IsHakdz,” and claims that he contacted TicketFly, warning them of serious security flaws that would allow a hacker to take control of the site and all of the company’s databases. He asked for 1 Bitcoin to reveal the technical details. When the company failed to respond, he decided to show them he was serious, and did exactly as he claimed he could do.
While you might question the hacker’s actions, his motives seemed pure enough, and the reality is that many companies have “Bug Bounty” programs where they pay researchers who find critical security flaws. The bounty payouts are typically less than a bitcoin, but the idea is the same. Unfortunately, TicketFly didn’t have such a program and even after having been warned of the flaws in their system, they took no meaningful action until the hacker forced them to do so.
While it’s not impossible to envision a scenario in which this hacker would resell the data he was able to get his hands on, the actions of this particular individual seem to point in the opposite direction. Even so, if you’ve made a purchase on the TicketFly database, it’s better to be safe than sorry, and carefully monitor the payment card you used to make the purchase. It goes without saying that you should change your TicketFly password immediately.
