Key Takeaways

• Incident Overview: Live Nation experienced a limited cybersecurity breach affecting customer data.
• Data Impact: The breach involved social security numbers, government IDs, and health records of two customers in Vermont.
• Company Response: Live Nation stated they took immediate action to secure their systems and are notifying affected individuals.
• Legal Consequences: The incident has led to three class action lawsuits alleging inadequate cybersecurity measures.

Live Nation was recently the target of a “limited” cybersecurity breach, the company has disclosed.

On Oct. 1, Live Nation notified the Vermont Attorney General’s online portal that two customers in the state were affected by a breach impacting social security numbers, government IDs and health records. No other state had posted a similar notification from Live Nation as of press time, though different states have varying laws about when and how a data breach is to be publicly reported.

It was not immediately clear when this data breach occurred, how many individuals were affected, or whether the victims were Live Nation customers or employees. The company said in a Wednesday (Oct. 7) statement to Billboard, “Live Nation takes the security of our systems and the information entrusted to us seriously.”

Related

“Recently, we identified, contained and secured a cybersecurity incident,” continued Live Nation’s statement. “Following a thorough internal review and independent investigation by a leading cybersecurity firm, we found the incident was limited in scope and had no impact on our operations. The small number of individuals whose information may have been affected are being notified and offered support in monitoring their information.”

The incident has already spawned three class action lawsuits alleging Live Nation didn’t have adequate cybersecurity measures in place to protect sensitive data. Such civil claims are common occurrence when a company discloses a data breach.

Live Nation previously faced two data breaches in 2018 and 2024, both targeting customers of its subsidiary Ticketmaster. The 2018 incident compromised payment information from British ticket buyers, and the company was ultimately fined £1.25 million ($1.65 million) by the U.K. Information Commissioner’s Office.

The 2024 breach was part of a larger hack on Snowflake, a popular third-party cloud storage service used by Ticketmaster. The hacking group ShinyHunters claimed responsibility for the cyberattack, and a Canadian citizen recently pleaded guilty to participating. Civil claims brought by customers against Ticketmaster and other Snowflake clients remain ongoing in U.S. court.