Los Angeles, CA - Live Nation Entertainment confirmed in a U.S. Securities and Exchange Commission filing on Friday that there was "unauthorized activity" in a third-party database, and a hacker claimed to have Ticketmaster consumer data for sale on the dark web. This announcement comes days after a lawsuit was filed, alleging the companies failed to secure customer data.

In a brief Form 8-K, Live Nation reported discovering the breach on May 20 within a third-party cloud database containing company data, primarily from its Ticketmaster subsidiary. The company is now working with forensic investigators to determine the extent of the breach and mitigate risks to both itself and its customers.

On May 27, a "criminal threat actor" offered what was alleged to be Ticketmaster user data for sale on the dark web. The hacker group ShinyHunters listed the private information of 560 million Ticketmaster customers for sale, a breach first reported by Italian media outlet Hackread.

Following this, consumers Cynthia Ryan and Rosalie Garcia, represented by Clarkson Law Firm PC, filed a lawsuit on Wednesday. They allege that Live Nation and Ticketmaster failed to implement adequate cybersecurity measures to protect customers' personal identifiable information. The data breach was attributed to the companies' negligence in securing their systems, enabling unauthorized third-party access to customers' personal data.

"The data breach was a direct result of defendants' failure to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect consumers' private information," the consumers stated in their lawsuit.

ShinyHunters claimed to have stolen 1.3 terabytes of personal data, which the lawsuit claims was only possible due to the companies' inadequate security measures. The compromised data includes names, addresses, phone numbers, order information, and partial payment card details, increasing the risk of identity theft.

The lawsuit notes that, as of Wednesday, Live Nation and Ticketmaster had not informed customers that their private information may have been compromised. The plaintiffs argue that the companies had a duty to maintain reasonable security measures to protect customer information but failed to do so, violating customers' rights.

The lawsuit also claims that Live Nation and Ticketmaster have not complied with Federal Trade Commission guidelines for protecting personal information. These guidelines include encrypting information, understanding network vulnerabilities, and using intrusion detection systems.

"Defendants failed to properly implement basic data security practices, allowing for this attack to occur, victimizing millions of people," the consumers alleged.

Ryan and Garcia seek to represent a nationwide class of individuals whose private information was compromised, as well as a California subclass. The lawsuit includes claims of negligence, breach of fiduciary duty, unjust enrichment, breach of implied contract, and violations of California's Consumer Privacy Act, Consumer Legal Remedies Act, and Unfair Competition Law.

The plaintiffs seek equitable and injunctive relief, an order for Live Nation and Ticketmaster to pay for credit monitoring services for the affected class members, actual and punitive damages, attorney fees, and litigation costs.

Representatives for Live Nation and Ticketmaster did not immediately respond to requests for comment.

Earlier this month, the U.S. Department of Justice sued Live Nation over the 2010 agreement clearing its purchase of Ticketmaster, aiming to unwind the deal blamed for issues like the Taylor Swift ticket sales fiasco. Consumers also filed an antitrust suit against Live Nation and Ticketmaster, alleging monopolistic practices in concert promotion and ticketing services.

Ryan and Garcia are represented by Ryan J. Clarkson, Yana Hart, and Tiara Avaness of Clarkson Law Firm PC.

The case is Cynthia Ryan et al. v. Ticketmaster LLC et al., case number 2:24-cv-04482, in the U.S. District Court for the Central District of California.