Massive Festival Ticket Buyer Database Appears for Sale on Dark Web, Targeting Brazilian Fraudsters

More than 400,000 records from the 2025 edition of The Town music festival have surfaced on a Russian-language data‑trading forum, where a seller is offering the compilation for a price of $10,000. The listing, posted on September 2, describes the trove as a "Ticketmaster database," and explicitly highlights the inclusion of Brazilian customer information.

The data set comprises personal details of individuals who purchased tickets for the event, including names, email addresses, phone numbers and payment‑related metadata. According to the seller, the Brazilian segment of the list is being marketed for illicit activities such as bank fraud, unsecured loan applications and SIM‑card registration, all of which rely on accurate personal identifiers to bypass verification checks.

Security researchers have long warned that large‑scale ticket‑sale platforms are attractive targets for cybercriminals because they aggregate high‑volume consumer data in a single repository. While Ticketmaster and similar services typically employ robust security measures, the breach suggests that third‑party vendors or ancillary systems linked to the festival may have been compromised, allowing attackers to extract the information without triggering immediate alerts.

Brazilian fraud rings have increasingly turned to stolen personal data to exploit weak identity‑verification processes in the country’s banking and telecommunications sectors. By pairing authentic contact details with fabricated documents, fraudsters can open new credit lines, secure loans or obtain prepaid SIM cards, which are then used to facilitate further scams or money‑laundering schemes.

The emergence of this dataset on a dark‑web marketplace underscores the growing commoditization of personal information. Prices for bulk records are often set based on the perceived utility of the data for specific crimes; in this case, the $10,000 asking price reflects the seller's confidence that the Brazilian entries will fetch additional revenue from fraud networks.

Authorities in multiple jurisdictions, including Brazil and the United Kingdom, have been alerted to the sale. Law enforcement agencies typically advise affected individuals to monitor financial statements, enable two‑factor authentication where possible, and consider credit‑monitoring services. Meanwhile, cybersecurity analysts recommend that event organizers audit their supply chains, enforce strict data‑handling protocols, and conduct regular penetration testing to mitigate the risk of similar leaks in the future.