EBay’s StubHub says accounts are secure after ticket heist

EBay-owned online ticketing company StubHub is moving to reassure customers that their accounts are secure, following the theft of more than US$1 million worth of tickets.

Online ticketing company, StubHub, has moved to reassure customers that their accounts are secure, following an international scheme involving the hacking of more than 1,600 StubHub accounts.

The company, which is owned by eBay, told customers in posts on Twitter and Facebook that accounts were secure, and that its technical and financial systems saw no intrusions.

"To be clear, your accounts are secure and there have been no intrusions into our technical or financial systems," the company said in its Facebook post. "A year ago, less than .006 percent of customer accounts were accessed by cyber criminals who had obtained customers' logins and passwords through data breaches of other businesses.

"Our Trust and Safety team immediately contacted affected customers, refunded any unauthorized transactions and assisted with changing passwords and securing their accounts," it said. "We've been working with New York City law enforcement and agencies around the world to bring these fraudsters to justice."

The scheme, which began last year, involved two Russian nationals, who hacked into accounts and bought up to 3,500 tickets using pre-existing payment information. They then emailed the tickets to two individuals in Manhattan and New Jersey, who resold the tickets, pocketing an estimated US$1.5 million.

Six of the alleged cyber-criminals involved in the scheme have been charged in New York, with the Manhattan District Attorney, Cyrus Vance Jr., announcing on 23 July that the individuals had been indicted on felony charges.

"Today we are announcing the indictment of six individuals, for their role in a criminal scheme in which more than 1,600 StubHub user accounts were compromised and used to purchase thousands of tickets," said Vance, in a media conference on Wednesday. "Those tickets were resold, and the proceeds were laundered through a global network of accomplices in the United States, the United Kingdom, Russia, and Canada.

"The defendants have been indicted on felony charges, including money laundering, grand larceny, and criminal possession of stolen property," he said.

The announcement comes after StubHub's parent company, eBay, asked customers in May to change their passwords following a cyber attack that compromised a database holding non-financial data.