Ticketmaster confirms massive breach after stolen data for sale online

**Executive summary:** On May 20–27, 2024 Live Nation/Ticketmaster disclosed unauthorized activity in a third‑party Snowflake cloud database that allegedly resulted in the theft of ~1.3TB of data containing details for approximately 560 million customers; the ShinyHunters actor claims responsibility and is offering the data for sale. The attackers reportedly used information‑stealing malware to obtain credentials, compromised a ServiceNow account to extract unexpired auth tokens and create session tokens to download customer data; Snowflake and forensic firms indicate compromised customer accounts without MFA and have published IOCs for investigation.