Short answer
Ticketmaster Brasil began emailing customers on 14 October 2026 about a security incident involving a third-party data analysis tool. It says passwords and full card numbers were not involved, and that it has reported the case to the ANPD.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Ticketmaster Brasil |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Ticketing and live events |
| Country | Brazil |
| Disclosed | 2026-10-14 |
| People or records affected | Customers who bought tickets in 2025; the company has not said how many |
What data was exposed
- Full name, gender and age range or birth date
- CPF or the document used for the purchase
- Phone number and email address
- City, state and neighborhood
- Purchase details, including payment method and last four card digits
What happened
Ticketmaster Brasil began notifying customers on Wednesday 14 October 2026, according to Canaltech. The company described the case as a “incidente de segurança envolvendo uma ferramenta de análise de dados fornecida por terceiros”, a security incident involving a data analysis tool supplied by a third party.
Ticketmaster says the cause was a temporary vulnerability in that tool. It says the affected database is not the one used for ticket sales or account management, and that those systems were not affected.
Who is affected
The notices go to people who bought tickets during 2025. The company has not said how many accounts are involved. The exact fields vary with what each customer gave at purchase. Canaltech lists name, CPF, contact details, location and purchase information. The version republished by Prensa Mercosur from Olhar Digital did not carry the field list, but it confirms the cause, the 2025 buyers and the ANPD notification.
Timeline
- 2025: Purchases covered by the incident.
- September 2026: Ticketmaster says its investigation with outside specialists was completed. We have not seen the date the tool was first compromised.
- 14 October 2026: Customer emails start.
- 15 October 2026: First press coverage.
What is not known
The company has not named the analytics provider, the number of people involved or how long the data was exposed. We have not seen any claim by hackers, and nothing we read links this to the 2024 global breach.
What to watch for
Ticket buyers are targeted by resale and refund fraud even without a breach, and a leak of CPFs and purchase details makes those messages more believable. See our guides on phishing messages, online shopping scams and the steps in what to do after a data breach. More cases are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake ticket-support messages that quote your name, CPF and the event you attended to ask for a password, a code or a 'verification' payment.
- Fake refund or resale offers for concerts and festivals, a common ticket fraud pattern in Brazil.
- Calls that mention the last four digits of your card to pose as your bank and ask you to move money.
- WhatsApp messages built on your purchase details with links to look-alike ticket sites.
What to do if you are affected
- 01Search your inbox, spam and trash for an email from Ticketmaster with 'incidente de segurança' (security incident) in the subject to confirm if you were notified.
- 02Change your Ticketmaster password, as the company advises, even though it says passwords were not exposed, and do not reuse it elsewhere.
- 03Treat messages that use your purchase data with suspicion. The company says its official channels do not ask for passwords or payment details without prior notice.
- 04Send questions to the company address given in the notice, incidente-dados@ticketmaster.com.br.
- 05Check Registrato from the Banco Central for accounts or loans in your CPF you do not recognise, and report any fraud to your bank and to the police (boletim de ocorrência).
Frequently asked questions
Was my Ticketmaster password stolen?
The company says the incident did not involve passwords or account login credentials. It still advises changing your password as a precaution.
Were full card numbers exposed?
No, according to Ticketmaster Brasil. Reported data includes the payment method and the last four digits of the card, not the full number.
Who is affected by the Ticketmaster Brasil incident?
People who bought tickets in 2025. Ticketmaster has not said how many were affected.
Is this the same as the 2024 Ticketmaster breach?
No. The 2024 case, claimed by a group called ShinyHunters, was a separate global incident. This one concerns a third-party analytics tool and 2025 purchases in Brazil.
Has Brazil's data protection authority been told?
Ticketmaster says it reported the case to the ANPD, Brazil's National Data Protection Authority.
Sources
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.