As the Ticketfly hacking crisis enters its first week, company officials are further from resolving the ticketing industry’s biggest scandal than many promoters and clients had hoped. While dozens (maybe hundreds) of Ticketfly-powered venue websites slowly come back online, company officials are still investigating the “cyber incident” and aren’t ready to share key details regarding what took place when a hacker defaced the site and forced Tickefly officials to take the entire platform offline.
Promoters describe having to scramble to work with Ticketfly and Eventbrite to keep their shows on sale, get patrons into their events and communicate with fans what was happening. Ticketfly was able to move a large portion of sales over to the Eventbrite platform, which helped to create website clones and handle the heavy-lifting for big festivals, like Riotfest in Chicago which went on sale to consumers in the middle of the hacking attack.
While many longtime supporters were willing to give Ticketfly the benefit of the doubt, patience is waning. In order for the company to begin the recovery process and regain the credibility they spent ten years building only to see it seriously jeopardized in less than 72 hours, Ticketfly officials need to eventually answer the four questions below.
This question lies at the heart of all other questions about how little we actually know about the hacking attack. Ticketfly still needs to explain how a hacker was able to gain access to the platform through WordPress, what data was stolen and compromised, what was damaged and what the company’s forensics team is finding in their investigation.
More importantly, Ticketfly officials need to explain why they decided to take the entire platform offline in response to the hacking attack. The decision to shut everything down, which Ticketfly’s officials said “was not taken lightly,” ground a large segment of the independent music industry to a halt and company officials need to explain in detail why they made the decision to go dark.
When is Everything Coming Back Online?
While Ticketfly officials have started restoring websites for venues, in most cases they aren’t relying on the original websites but instead are creating quickly made clone sites that allow consumers to buy tickets, but don’t include much other information about the venue.
“For those of you with Ticketfly-powered websites, some of you are live on the temporary solution and more sites are continuing to go live by the hour. We apologize for not hitting the timing we communicated yesterday, but assure you that as your webpage goes live, you will be notified,” a letter from Ticketfly to promoters sent Sunday night explains.
Ticketfly.com, the Ticketfly iOS app, Promoter, Pulse, and Fanbase tools are still offline, while the company’s emailer product isn’t allowing promoters to use the templates they’ve created, requiring many to start from scratch.
What Information was Stolen?
The hacker who claimed responsibility for the attack said he or she not only stole customer data, but accessed the company’s Backstage database which contains sensitive internal business data which could be used against promoters, agents and even Ticketfly itself. So far, Ticketfly officials have not confirmed whether the Backstage database was compromised and have little information to share about what stolen confidential data is hovering out there on the interwebs. Unlike consumer data — which seems to be stolen and breached every few weeks in a new high profile hack — the leak of the Backstage database could be embarrassing to agents who often charge venues different prices for artists and could have their artist’s actual earning power broadcast to future buyers.
“It would be like sharing an artist’s Pollstar data with the world, except this information would actually be accurate,” said one high-profile promoter affected by the attack. “And for me as a buyer, that same information could be used against me next time I try to buy a show. There’s nothing good about having my data floating around the internet.”
Ticketfly officials have acknowledged consumer data including names, addresses, emails, and phone numbers of consumers had been breached, after screenshots of the information started popping up around Twitter.
“We understand the importance our customers place on the privacy and security of their data and we deeply regret any unauthorized access to it. This is an ongoing investigation and we will continue to provide updates as appropriate,” a statement from TF reads.
Who is Going to Pay?
The Ticketfly outage meant many clients lost out on a busy summer weekend of ticket sales that will absolutely affect P+Ls and mean May/June sales declines for venue clients. There’s also damage to venue’s brands —”fans who log in see the site is down often think it’s the venue that got hacked, not Ticketfly” said one Southern California booker affected by the hack, who said he also had to pay the costs of the workarounds needed to stay operational during the outage while a clone site was being built.
It’s one thing for Ticketfly to get its system fully back online — which it hasn’t done yet — but there’s another question of whether the company is liable for lost sales caused by the large outage. Ticketing systems, including Ticketmaster, go down all the time and typically the ticketing company works with the promoter to offset the damage, but the scale of the Ticketfly outage, the length of time the system was down and the number of sales lost could quickly add up to a big number that Ticketfly and its owners at Eventbrite might not be ready to face.