Central Tickets data breach

[khiar]

I received an email alert from the 'have I been pwned' service which monitors your email address for any security incidents, unfortunately Central Tickets customer data has been leaked:

In September 2024, data from the ticketing service Central Tickets was publicly posted to a hacking forum. The data suggests the breach occurred several months earlier and exposed 723k unique email addresses alongside names, phone numbers, IP addresses, purchases and passwords stored as unsalted SHA-1 hashes.

Unsalted hashes are not very secure so I am treating this as a leaked password - best to change your Central Tickets password and anywhere else you might have used that password.

I have been getting more spam calls and emails lately, though I'm not sure if that's related 

[matty]

Email from Central Tickets CEO...

Good Evening,

We are aware of reports suggesting that we may have experienced a potential data breach and we are actively working to verify these claims.

Based on our current understanding, the potential breach could have affected basic personal information, such as names, mobile numbers, and email addresses of our members. Please be assured that we do not process or store any sensitive or high-risk data.

Hashed account passwords may also have been involved in the potential breach. However, these are encrypted, so there is no immediate concern about the security of your password. Nonetheless, if you use the same password on other sites, we recommend changing it as a precaution.

We reported our concerns to the Information Commissioner’s Office (ICO) within 72 hours of discovering the potential breach and engaged a third-party Cyber Incident Response (CIR) Team within the same timeframe. The CIR Team is investigating the reports, conducting a comprehensive audit of our IT systems, and identifying any vulnerabilities. This process is ongoing, and we expect to have further information within the next week. In the meantime, we have implemented several measures to ensure your data is secured.

In the interim period, please remain vigilant for any suspicious calls or phishing emails, as these are the most likely risks related to the specific data we hold.

We sincerely apologise for any concern or inconvenience this may cause and will update you as soon as we have more information.

Lee McIntosh

Chief Executive Officer

[Adalea]

I have a separate email address that I use for my daily theatre newsletters, todaytix, and similar. It's a fairly new email address and I've only used it at the big name websites. I received 3 really strange phishing emails in the last day or so. Clearly related to this leak.

[anita]

I never received an "alert" but can't log in. It says I need to change my password.

[anita]

Oct 2, 2024 9:55:47 GMT anita said:

I never received an "alert" but can't log in. It says I need to change my password.

It doesn't recognise my password so won't let me change it so I can't see the offers.

[FrontrowverPaul]

I tried to access my account on this phone at 6pm tonight but password also not recognised. Fortunately I had printed the order confirmation with reference number which I booked on PC with the password a couple of weeks ago. Won't say which show or theatre but box office very helpful and quickly issued ticket. Usually I'm at home when they send out evening seat filling details around 4pm but with a matinee today had to rely on phone