ST PAUL, Minn. — Fans who made it through the rain to Allianz Field Tuesday night to see the U.S. Women's soccer team take on South Korea knew they were coming to a safe place, thanks to extensive security protocols.
But stadium security and cybersecurity are two different games. The company they bought their tickets from, Ticketmaster, has reported a possible data breach of massive proportions.
"I didn't get any notice, and I go to a lot of concerts and events," Kayla Truong told KARE.
"So, that's kind of scary. I'm not gonna lie. That's a little scary."
Data breaches have become so common, some customers weren't shocked to hear about it.
"I didn't know about it. But that’s, unfortunately, the kind of the world we live in, right?" Ticketmaster customer Kevin Chang remarked.
"You just kind of make sure you're watching your own accounts. Make sure you're basically staying on top of your own personal security in that sense."
Ticketmaster and parent company Live Nation haven't released any statements yet and didn't reply to inquiries from KARE on Tuesday. The company has filed a notice with the Federal Trade Commission of a possible data breach and apparent ransom demand.
"So, someone claims to have stolen half a billion customer records from Ticketmaster and is trying to sell that treasure trove of data for half-a-million dollars," cybersecurity expert Bryce Austin of TCE Strategy told KARE.
"I’m concerned that they’ve taken a tremendous amount of data; that they may have data about what concerts we’ve been to, what seats we chose, which says a lot about our economic status."
Austin said there's always an uptick in phishing attempts after a major breach like this one. The notion that hackers possess your concert ticket history opens up all kinds of scenarios for those cyber criminals.
"If we have bought front row tickets at an expensive concert, they can infer that we likely have a bank account large enough to be worth their while to try to spear phish us and steal it."
He explained that spear phishing is a more personalized online attack compared to regular phishing.
"If someone sent me a phishing email it would say something like, 'I thought this was interesting, please click here.' That’s standard phishing. But if you really want to go after me, say, 'I cannot believe Taylor Swift said this after the concert you and I went to last week.' And that's spearfishing."
Austin said it's good idea to change your Ticketmaster password as a basic precaution. He said freezing credit is always good advice, but in this case, it may be premature to freeze your credit.
That's because the full scope of the breach is still unfolding. At some point Ticketmaster will be required to notify customers what steps to take, but those notification rules vary from state to state and country to country.
In the meantime, those soccer fans and Ticketmaster customers in general have more reason to keep their eyes on the ball.
"You need to look at the email address, not just what it looks like. And if it's too good to be true it probably is, so don't click on it, and ask around," Mike Woodruff told KARE on his way into Allianz Field Tuesday night.
Fellow soccer fan Matt Freechack said for him it's all about being careful.
"The key in that is just to be smart about it and look for those kinds of scams and things like that. I get calls from India every other day, maybe every day!"
The U.S. Department of Justice launched an anti-trust lawsuit against Live Nation and Ticketmaster on May 23, as part of an effort to break up the companies. The federal government has taken the stance that Live Nation and Ticketmaster control so much of the ticket market that they constitute a monopoly.
Companies that suffer breaches can also face lawsuits from victims as well as penalties from government regulators. In fact, some California customers have already sued Ticketmaster over this reported breach.
But Austin says many companies are willing to absorb cost of paying ransoms, legal settlements, and fines rather than spend more upfront on cybersecurity. He said the penalties aren't yet severe enough to outweigh the cost of preventing those breaches in the first place.
Live Nation owns three venues in the Twin Cities area, including The Fillmore, The Uptown, and The Varsity.