Central Tickets data breach: what happened, has personal information been stolen and how to protect passwords?

A ticketing company has urged customers to consider changing their password after it confirmed it had been the victim of a data breach. Users' personal information may have been among the information stolen from Central Tickets, it has warned. 

The platform, which specialises in discount prices for theatre shows in London, confirmed it had suffered a breach in an email to customers this week. The Independent reports that chief executive Lee McIntosh reached out to users after being alerted by Metropolitan Police. 

According to Hackread, the exec warned customers that personal information could have been affected - including details such as “names, mobile phone numbers and email addresses”. He also advised that customers may need to consider changing their passwords as well. 

What has Central Tickets said about the breach? 

The company has admitted that there had been “a data breach” and customers personal information may have been compromised as a result. It is believed to have happened on July 1, but Central Tickets only became aware of it in September after being alerted by the Metropolitan Police after chatter was spotted on the dark web. 

According to The Independent, the firm said a “staging database” which is used for testing purposes had been breached by a “threat actor”. This is said to be different from its main website and app. 

Central Tickets has reported the potential breach to the Information Commissioner’s Office (ICO). Mr McIntosh added: “I acknowledge the seriousness of the situation and I would like to offer my unreserved apology to you for any distress or concern this may have caused.” 

Should I change my password? 

In an earlier email to customers, seen by Hackread, Central Tickets advised that “hashed account passwords” may have also been involved in a potential breach but says these are “encrypted”. However customers are advised if they use the same password for other websites they should change it as “a precaution”. 

But Central Tickets, after receiving a summary report from an external cybersecurity team, identified the breach as having affected a “staging database” and not its main website and app. However it is good online safety practice to use different passwords for different websites just in case. 

Users were also warned to remain vigilant for scam phone calls and phishing emails following the incident.