Ticketmaster Data Breach Lawsuit: Who Qualifies and Where the Case Stands

Ticketmaster stored customer data in a cloud database run on Snowflake, a data-warehouse platform used by many large companies. In spring 2024, attackers reportedly used stolen login credentials to get into several companies' Snowflake accounts and copy data out. Ticketmaster's notice to the Maine Attorney General says an unauthorized party accessed its Snowflake database between April 2 and May 18, 2024.

Live Nation, Ticketmaster's parent company, told investors in a Form 8-K filed May 31, 2024 that it had found "unauthorized activity" in a third-party cloud database on May 20, 2024, and that a criminal actor had offered what it claimed was Ticketmaster user data for sale on the dark web. A group calling itself ShinyHunters advertised the data and claimed it covered 560 million customers. Treat that number with care: it is the seller's claim, not a figure Ticketmaster has confirmed.

Ticketmaster began notifying customers in early July 2024. Its public statement said the incident affected people who bought tickets to events in North America (the U.S., Canada, and Mexico). According to the notices and Ticketmaster's own updates, the exposed information may include:

• Names and basic contact information, including email address and phone number
• Event and order details
• Encrypted credit card information, and in some reports the card type, last four digits, and expiration date

The Maine filing listed more than 1,000 Maine residents. Ticketmaster has not published a nationwide total. This was a data breach at a vendor's platform, which is why the lawsuits name both Ticketmaster and Snowflake.

The first proposed class action, Ryan v. Ticketmaster, LLC, was filed May 29, 2024 in the Central District of California, before Live Nation's securities filing. Dozens of similar suits followed against Ticketmaster and other Snowflake customers, including AT&T, Advance Auto Parts, Neiman Marcus, and LendingTree.

The Judicial Panel on Multidistrict Litigation centralized the federal cases on October 4, 2024, finding that they shared common questions about "a cluster of breaches" on the Snowflake platform. The multidistrict litigation, In re Snowflake, Inc., Data Security Breach Litigation, MDL No. 3126 (No. 2:24-md-03126), is assigned to Chief Judge Brian Morris of the District of Montana. An MDL groups cases for pretrial work; it is not a settlement. Our guide to how MDLs work explains the process.

On October 28, 2025, the court ruled on motions to dismiss. For the Ticketmaster track it dismissed breach of contract and the California Unfair Competition Law claim, but allowed negligence, California Consumer Privacy Act, and certain state consumer-protection claims to go forward. It also denied Snowflake's own motion to dismiss.

The case is now in discovery. In a June 29, 2026 order on Ticketmaster's motion to compel, Judge Morris noted the parties "have been engaged in discovery for many months," that substantial completion of document production was due July 31, 2026, and that the named consumer plaintiffs must either produce records supporting their fraud claims or certify that they have none. That order is a useful signal: proof of actual harm is being tested now, not assumed.

No class has been certified and Ticketmaster denies the allegations. Other defendants in the same MDL have settled (the court granted final approval of the Advance Auto Parts settlement on October 23, 2025, and preliminary approval of a Neiman Marcus settlement in May 2025), but those deals do not cover Ticketmaster customers.

If a class is certified or a settlement is reached, the class will be defined by the court. Based on the consolidated claims, the people most likely to be included are:

• U.S. residents who received a Ticketmaster breach notice in 2024.
• People whose personal or payment information was stored in the Ticketmaster Snowflake database that was accessed between April 2 and May 18, 2024.
• For state-law claims, residents of the states whose statutes survived dismissal, including California residents under the CCPA.

You probably do not have a claim if you never had a Ticketmaster account or order, or if you received no notice and cannot show your data was in the affected database. Having your data exposed is not the same as having a strong individual case. Courts and settlements usually pay more to people who can document identity theft, fraudulent charges, or money spent on protection.

If you never got a notice

Ticketmaster said it would send notices only to people it believed had sensitive information involved. If you bought tickets in 2024 or earlier but never got a notice, check the email address tied to your Ticketmaster account, including spam folders, for messages from July 2024 onward. If you still find nothing, you may not be in the affected group, though a future settlement notice will describe the class and may let you check.

Customers in Canada and Mexico

Ticketmaster said buyers of tickets to events in Canada and Mexico were affected too. The MDL is a U.S. federal proceeding, and its proposed classes are built around U.S. residents and U.S. state laws. People outside the U.S. should look to the privacy regulators and courts where they live.

You do not need to sign up anywhere to stay in a proposed class. If a settlement is approved, notice will go out and the only place to file will be the court-approved settlement website. Beware of settlement scams that ask for fees or card numbers to "register" you.

There is no Ticketmaster settlement, so any dollar figure you see online for this case is a guess. What we can say is how data breach settlements usually work and what the law allows.

The California Consumer Privacy Act lets California residents recover statutory damages of $100 to $750 per consumer per incident, or actual damages if greater, when a business's failure to use reasonable security leads to a breach of certain personal information. That is one reason the CCPA claim surviving dismissal matters. Other states' consumer-protection laws have their own remedies, and negligence claims generally require proof of actual loss.

Typical data breach settlements offer some mix of:

Benefit	Who it is for	What you usually need
Documented losses	People with fraud or costs	Receipts, statements
Lost time payment	People who spent hours responding	A sworn statement
Flat cash payment	Everyone in the class	A valid claim
Credit monitoring	Everyone in the class	A valid claim

Flat payments in very large breach settlements are often small because the fund is split among millions of people. For real figures from past cases, see how much a data breach settlement is worth. Nothing here means you will receive money from this case.

The consumer plaintiffs allege that Ticketmaster and Snowflake failed to use reasonable security, including multi-factor authentication and access controls, and failed to give timely notice. The claims that survived the October 2025 ruling are:

1. Negligence: a company that collects personal data owes a duty to protect it with reasonable care, and a breach of that duty that causes harm can support damages.
2. California Consumer Privacy Act, Cal. Civ. Code § 1798.150: a private right of action when nonencrypted and nonredacted personal information is stolen because of unreasonable security.
3. State consumer-protection statutes: the court allowed claims under the Montana Consumer Protection Act and New York General Business Law § 349 to continue.

The claims that were dismissed matter too. Breach of contract failed at this stage, and so did the California Unfair Competition Law claim, which can limit some theories of recovery for California buyers. What remains still has to be proven with evidence, and Ticketmaster can challenge class certification, bring a motion for summary judgment, or settle.

Snowflake's role is the unusual part. The JPML noted the plaintiffs' allegation that Snowflake works under a "shared responsibility" security model and is jointly responsible with its clients for protecting data on its platform. The MDL covers breaches that the JPML said exposed the personal information of over 500 million consumers and employees across all Snowflake clients combined.

There is no claim deadline because there is no settlement. The timing issues that matter now are:

• Staying in the class is automatic. While the MDL is pending, you do not need to file anything to be part of any future class.
• Individual suits have limits. If you want to bring your own case, state statutes of limitations for negligence and consumer-protection claims usually run 2 to 6 years, often from when you learned of the harm. The filing of a class action generally pauses the clock for class members, but an attorney should confirm the rule in your state.
• Settlement deadlines come later. If a deal is reached, the notice will list a claim deadline, usually a few months out, and a separate date to opt out or object.

The breach window was April 2 to May 18, 2024, so fraud that began after that period is the kind of harm the case is focused on.

1. Keep the notice. Save the email or letter. It is the simplest proof that your data was involved.
2. Freeze your credit with Equifax, Experian, and TransUnion. It is free and blocks new accounts in your name.
3. Check card statements back to April 2024 and report any fraud to your bank right away.
4. Watch for phishing. Scammers use breach news to send fake "refund" or "settlement" emails. Ticketmaster will never ask for your full card number by email.
5. Write down your time and costs. Courts in this MDL are asking plaintiffs to back up their harm with documents, and settlements often pay for documented losses.

Our step-by-step guide on what to do after a data breach notice covers each step. If you had fraud, identity theft, or significant costs, independent attorneys who handle data breach cases can look at whether you have a stronger individual claim. A free case review takes about two minutes. You can also read our overview of how data breach lawsuits work.