Entertainment services giant Legends International discloses data breach

Entertainment venue management firm Legends International warns it suffered a data breach in November 2024, which has impacted employees and people who visited venues under its management.

In a notification letter shared with the authorities, the company informs that it detected unauthorized activity in its IT systems on November 9, 2024, prompting an investigation carried out with the help of external cybersecurity experts.

The investigation results confirmed that the intruders had exfiltrated personal data files, though the exposed data types aren’t determined in the sample letter.

Legends International is a global sports and entertainment services company offering venue planning, sales, partnerships, hospitality, merchandise, and technology solutions, with an annual revenue of over $1.1 billion.

It manages over 350 venues across five continents, including the SoFi Stadium in Los Angeles, One World Observatory in New York, the AT&T Stadium in Texas, the Santiago Bernabeu and Camp Nou stadiums in Spain, and the Anfield and OVO Arena Wembley in the UK.

Recently, the company expanded its operations by acquiring ASM Global, a leading venue management company with a worldwide footprint.

The scope of the data breach and the number of exposed individuals remains unknown. However, given the size of the company’s operations and the large amounts of sensitive data it manages, there’s ground for concern.

BleepingComputer has contacted the company to ask for more details, but a comment wasn’t immediately available.

In the letter sent to impacted individuals, Legends International says security measures were already in place before the incident, and it implemented additional measures when the systems were restored from the cyberattack. However, no specific details about either were given.

Letter recipients are offered 24-month coverage for identity theft detection services through Experian and are given until July 31, 2025, to enroll.

Legends International states in the letter that they are not aware of any evidence that personal information has been misused as a result of this incident, but people are advised to remain vigilant.

At the time of writing this, no ransomware groups have taken responsibility for the attack at Legends International, so the type of the attack and the perpetrators remain unknown.