Hacker News Reader

Comment by CaptainZapp | Hacker News Reader

"As of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations. We continue to evaluate the risks and our remediation efforts are ongoing"

Ah, All is well then. It has no material impact on your business.

So, the 600'000'000 affected customers can kindly go and fuck themselves?

View on HN

Look, I get just being blindly outraged at a hack and the hate that Ticketmaster seems to generate, but the company wrote this for the regulators and shareholders as much as anything.

They have a legal duty to report hacks and report if it will have any affect on their business. And this is what they are doing here. Being outraged because a company does what they are legally obliged to do just makes you angry for no reason.

They'll address the hack to customers no doubt, in a separate email/communication.

At no point did they say the 600M people "can kindly go and fuck themselves" and contorting things to try and get there will just make you angry. If you want to blindly feel anger, you're welcome to, but the company did what they should here.

>At no point did they say the 600M people "can kindly go and fuck themselves"

With nary a word this was fully implied way before they even started collecting customer data.

Companies can have this attitude regardlless of whether there is any data at all.

>> At no point did they say the 600M people "can kindly go and fuck themselves"

That is exactly what they said. Verbatim. That's how my brain received it, anyway.

Then you should see a doctor because you're either hallucinating or don't know what verbatim means. This is a specific communication for a specific audience and there are legal requirements around what is reported.

I see both sides of this, but I think I would side with the original comment. It's not just blind outrage or something like that. The point is that there ought to be impact on Ticketmaster business. The messed up and there should be a cost to the company. They should be paying big fines or compensating their users. It should be entirely possible for a company to go bankrupt in such a situation which would incentivise better internal practices.

So this is an interesting case because by all accounts it was Snowflake that got compromised, not Ticketmaster themselves. So this isn’t them messing up but their vendor. I get the argument that you are responsible for your vendors, but at the same time the whole point of buying a SaaS product is precisely to hire domain experts to run a piece of infrastructure that you have less experience with. Security is very hard even for major companies with a stronger culture of it who spend much more resources on it like Apple and Google. It’s not clear that if Ticketmaster would have done a better job.

I think the view I’m most sympathetic too is that customer information should be viewed and reported on as a toxic asset/liability to discourage gathering of personal information in the first place.

The problem is that there is no material impact due to these issues. The shareholders should absolutely be impacted and the company on the hook for damages

> At no point did they say the 600M people "can kindly go and fuck themselves"

It's TicketMaster, that's their business model. No need to say it again in this message to the SEC.

They basically said:

- no expected damage for the leak

   - no cost for any remediation 

   - no cost for any legal issue

 - no expected cost to ensure it does not happen again

If you believe that they should be impacted then it's kind of a Fuck you.

They are not the ones making the law but it certainly looks like they will plainly use the fact that they can continue business as usual with almost no impact.

The more damning part is this though 'Ticketmaster refused to confirm it to reporters or customers and instead notified shareholders late on Friday.'

They cared more about there shareholders than users.

Hey now, Ticketmaster will continue to fuck us too!

The PR is for shareholders, not the peasants.

That's just a requirement for the SEC filing. If it has interrupted business operation, it needs to be specified. Think if a hospital or a manufacturer has a breach.

This statement is for investors and managers, not customers. Customers don't typically read statements filed with the SEC. Companies get hacked all the time and the material effect on the underlying business is, indeed, often not significant. Especially for something as monstrously huge as TicketMaster.

Sounds like the Equifax breach response ;) nothing to worry I guess

They aren't wrong, consequences for them are likely light. There's simultaneously a huge breach with Snowflake, which is high impact as many companies would have their customer data in a platform like that. And past breaches like Equifax that exposed almost everyone.

They are mostly just acknowledging that the general public has "breach fatigue". Nobody cares anymore. It's just another 12 months of free monitoring on top of the others you already have. So now you just freeze your credit until you need a loan, unfreeze it, put it back.

Oh. Come on. This isn’t the Joe Bloggs News comment section. That quote is from an SEC filing. The literal purpose is to update shareholders on exactly this. There’s so much to hate about TM without stooping to this.

It wasn't the shareholders' data that was leaked.

A bit of contrition is required. Not a nice to have. Not contextual. Required.

Not in an SEC filing, it's not.

Reply on news.ycombinator.com