Ticketing services agency See Tickets has notified more than 300,000 individuals that their payment card data was stolen in a new web skimmer attack.
Owned by Vivendi SA, See Tickets provides ticketing services for a broad range of event types, including comedy, festival, lifestyle, and sport, and operates both regional and international websites in North America and Europe.
In a data breach notification letter sent to the affected individuals, a copy of which was submitted to the Maine Attorney General’s Office, See Tickets says the new attack was identified in May 2023 and completely shut down in July.
“In May 2023, See Tickets became aware of unusual activity on certain of its e-commerce websites,” the agency notes in the notification letter.
A forensics firm retained to investigate the hacker attack discovered that, in May and June 2023, an unauthorized third-party “inserted multiple instances of malicious code into a number of [See Tickets’] e-commerce checkout pages”, See Tickets explains.
Between February 28 and July 2, the malicious code – which is typically referred to as a web skimmer – collected and exfiltrated the information that users provided on those checkout pages, including their names, addresses, and payment card information.
The ticketing services agency also notes that it has no evidence to suggest that the stolen personal information was fraudulently used. However, such data is typically shared between cybercriminals and used to perform various types of fraud.
See Tickets claims to have implemented additional safeguards to protect payment card information on its web pages, but this is the second time in the past year that it warns users of a web skimmer on its websites.
Disclosed in October 2022 and impacting names, addresses, and payment card data, the first skimmer attack was identified in April 2021 but only shut down in January 2022.
Related: See Tickets Customer Payment Card Data Stolen by Web Skimmer
Related: Website of Canadian Liquor Distributor LCBO Infected With Web Skimmer
Related: Hundreds of eCommerce Domains Infected With Google Tag Manager-Based Skimmers