Hacker News Reader

Comment by skilled | Hacker News Reader

vx-underground on Twitter,

> Based on data provided to us by the Threat Group responsible for the compromise, we can assert with a high degree of confidence the data is legitimate. Date ranges in the database appear to go as far back as 2011. However, some dates show information from the mid-2000's.

> NOTE: The data provided to us, even as a 'sample', was absurdly large and made it difficult to review in depth. We are unable to verify the authenticity of financial information. Briefly skimming the PII present in the dump, it appears authentic.

https://x.com/vxunderground/status/1796063116574314642

---

No official confirmation yet.

View on HN

SEC registrants are required to make a disclosure within 4 business days once a cybersecurity incident is deemed by the company to be material to a reasonable investor.

https://www.sec.gov/news/statement/gerding-cybersecurity-dis...

Yep! I am aware of this.

All my previous comments on this specific story have been that this isn’t verified.

Lots of major news sites pulled the trigger on the headline for nothing more than clicks.

Some journalists say that Australian Home Affairs confirmed the breach… lol! They acknowledged the rumour, but that got spun as “verification”.

Then again, maybe it’s lack of decent cybersecurity writers.

I personally can’t stand this weaksauce writing with no fact checking and the nonchalant way of throwing companies under the bus.

Ticketmaster has engaged the ACSC[1]. I doubt its a rumour.

[1] https://www.linkedin.com/posts/aucyberseccoord_today-i-was-a...

This story was initially circulated two days ago with a blanket statement of “AUS Home Affairs confirms the breach” - which at the time was false because they only acknowledged the rumour.

Whether or not it’s a rumour based on speculation has nothing to do with it. It either is or it isn’t.

There is no confirmation that it isn’t.

Just to provide receipts:

Home Affairs Department confirms cyber incident impacting Ticketmaster customers (https://www.abc.net.au/news/2024-05-29/ticketmaster-hack-all...) - May 29th

> The Department of Home Affairs said it is aware of a cyber incident impacting Ticketmaster customers in response to claims it is part of a data leak expected to impact millions of customers globally.

How exactly "being aware" counts as "confirmation" in this case?

Any other article (outside of those who used ABC Aus as a source) on this matter have specifically used words like "allegedly", "purported", etc.

That's the only argument I am making.

If you mean this article https://www.abc.net.au/news/2024-05-29/ticketmaster-hack-all...

It clearly says:

A spokesperson from the Department of Home Affairs told the ABC it is "Working with Ticketmaster to understand the incident".

Which is more than they are aware of a rumour

Ticketek != Ticketmaster.

Tickettek is Australia's largest ticketing company and a competitor to Ticketmaster

Weird, that Ticketek is also sending out emails that they have been compromised at the same time as Ticket Master

> Lots of major news sites pulled the trigger on the headline for nothing more than clicks.

Are you saying data was stolen? Because the headline here is "allegedly." So, unless you know absolutely one way or the other, allegedly is accurate.

Mashable -> Ticketmaster hacked. Breach affects more than half a billion users.

Irish Independent -> Hackers access half a billion customers’ data in Ticketmaster cyber attack

Gizmodo -> Ticketmaster Hack Reveals Sensitive Data for 560 Million People

Daily Mail -> Details of 560 million Ticketmaster customers are stolen in data leak

And so on...

(all these stories/headlines were published on May 29th, on the day when the rumor began to spread)

Filing submitted: https://news.ycombinator.com/item?id=40543408

https://stackdiary.com/ticketmaster-confirms-data-breach-wit...

Filing: https://www.sec.gov/Archives/edgar/data/1335258/000133525824...

> material to a reasonable investor.

As long as the investor is hurt, right? The users are just collateral.

Any negative news that can influence the share price is material information. A hack, involving payment means, of 500M users is definitely material information.

Also. As the excellent Matt Levine never ceases to repeat : everything is securities fraud.

If you didn't state in your regular filings "our security is poor, we may get hacked", then you lied by omission.

The SEC’s job is the integrity of the securities market. The user would be the concern of a consumer rights authority (the FTC) or a privacy protection one (I don’t think the US has one of those on the federal level?). That the SEC is the way we learn about these things is nothing more than a relatively recent hack, and how widespread the damage from that hackery is going to be is not yet clear.

(E.g. “money laundering” seemed like a reasonable hack for the first couple of decades, but these days banks have turned into an surveillance and enforcement apparatus with a presumption of guilt and no right of appeal.)

I don't make the rules, and it is unfortunate there is still a wide gap between current state and desired end state wrt citizen harm; to understand the rules is to leverage them to arrive at a desired outcome. Code for some hackers, legal and regulatory frameworks for others. Simply different syntax, runtimes, and exception handling.

Opposite.

SEC 8K being enforced has been nothing but good overall.

These companies were being hacked and it was hidden from you.

Now, it’s open, embarrassing, and costly. So they’re taking security more seriously.

If you are concerned about share price, buy the dip on hack.

The reason the investors care is presumably because of the fear that there will be significant, material financial consequences for the business arising from harms that affect the users.

If the expectation was that users were screwed and would not be entitled to any compensation, then the news of this breach would be no more material to the company’s investors than learning the at the air conditioning was set to the wrong temperature in one of the company’s offices for a few hours.

“The SEC doesn’t care about users” is a a weird complaint. A bit like “The IRS doesn’t care about climate change”.

Reply on news.ycombinator.com