Breach Disclosure: Ticketcounter

Ticketcounter, a Dutch e-ticketing platform recently experienced a data breach impacting 1.9 million users. Included in the data were full names, email addresses, phone numbers, IP Addresses, and hashed passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The actual breach date of Ticketcounter is not known, however, the threat actor responsible for the breach initiall listed it on a popular hacking forum on February 21st, 2021, however, was quickly removed. The initial breach appears to be the result of an unsecured Microsoft Azure server which was used to test data anomyization.

The threat actor reached out to Ticketcounter and demanded seven Bitcoins (approximately $337,000) to not release the data. Included in the demands, the threat actor stated that if they did not recieve payment, they would release the data as well as notify all the partners of Ticketcounter. Ticketcounter mitigated some impact by preemptively notifying their customers and clients that a breach has taken place and to perform breach notifications to those affected.

Once the threat actor did not receive their payment, they released it for free on various hacking forums for anyone to download.

Figure 1: Another user posting the data for free since the original was taken down