Ethical Hacking News
Over 412,000 ticket buyers from The Town 2025 festival in São Paulo, Brazil have seen their personal data exposed on the dark web, with sensitive information including CPF numbers, phone numbers, and neighborhoods available for sale for $10,000. Experts are warning festival-goers to be vigilant and to treat their CPF numbers as exposed, with potential risks including identity theft, SIM swap attempts, and scam calls.
The personal data of over 412,000 Ticketmaster customers has been breached and listed for sale on the dark web.The data breach, which occurred in August 2026, is believed to have been shared with a promoter, sponsor, or partner, rather than directly stolen from Ticketmaster.The breach has left festival-goers and security experts reeling, with over 61% of the data belonging to Brazilian citizens.The stolen data includes CPF numbers, which are highly sensitive and can be used for identity theft and fraud.Security experts are warning festival-goers to be vigilant and to treat their CPF numbers as exposed.The breach highlights the industry-wide blind spot surrounding the handling of sensitive data in live-events companies.Security experts are calling for greater transparency and better protection of sensitive data.
In a shocking turn of events, the dark web has been flooded with the personal data of over 412,000 ticket buyers from The Town 2025 festival in São Paulo, Brazil. The data, which includes names, email addresses, CPF numbers, phone numbers, neighborhoods, ticket types, and payment details, has been listed for sale on a Russian-language data-trading forum for a staggering $10,000.
The data breach, which occurred in August 2026, has left festival-goers and security experts alike reeling. According to Ransomnews, the report that first uncovered the breach, the data was exported from a live database dump, which suggests that the data was not directly stolen from Ticketmaster, but rather was shared with a promoter, sponsor, payment provider, or another partner.
The sheer scale of the breach is staggering, with over 61% of the data belonging to Brazilian citizens. The data includes CPF numbers, which are highly sensitive and can be used for identity theft and fraud. The seller explicitly markets the CPF numbers for credit and telecoms fraud, making it a lucrative target for scammers.
Security experts are warning festival-goers to be vigilant and to treat their CPF numbers as exposed. They recommend checking credit records through Brazil's Central Bank registry or services like Serasa for accounts that were not opened. They also warn of SIM swap attempts and scam calls referencing festival purchases, which could be used to trick victims into revealing sensitive information.
The breach highlights the industry-wide blind spot surrounding the handling of sensitive data in live-events companies. These companies often hold national identity numbers, verified phone numbers, and home neighborhoods for hundreds of thousands of people, which are then shared with partners and may be vulnerable to data breaches.
The incident also raises questions about the security measures in place to protect sensitive data. Ticketmaster has not yet commented on the breach, but security experts are calling for greater transparency and better protection of sensitive data.
In a related development, Chaotic Eclipse has released several new zero-day exploits, including FalconFlank, which targets Crowdstrike Falcon ZeroDay. Another APT, Mirage Kitten, has been linked to Iran, and is using fake job tests to spread malware. The security landscape continues to evolve, and it's essential for users to stay informed and vigilant.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Dark-Web-The-Great-Ticketmaster-Breach-of-2025-ehn.shtml
https://securityaffairs.com/198354/data-breach/412000-the-town-2025-ticket-buyers-data-hits-the-dark-web.html
https://axis-intelligence.com/dark-web-statistics/
Published: Thu Sep 3 09:35:23 2026 by llama3.2 3B Q4_K_M
