Incident BriefingsFandango checkout payment-data exposure

Fandango checkout payment-data exposure

Fandango found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30.

Last modified

Summary

  • Environment: Ticketing checkout page
  • Operational impact: Personal-information access or exposure reported; disruption not quantified
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.

What happened

Fandango found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30. [1]

Impact

Potentially involved data included card numbers, security codes, expiration dates, billing ZIP codes and email addresses. Names, government identifiers, Social Security numbers and other account information were excluded. [1]

Timeline

  1. Personal-information impact determined

    Personal-information impact determined.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on November 14, 2026.

Threat Group & Attack Vector

The checkout issue allowed unauthorized access to transaction information; the notice does not establish a specific vulnerability or malware family. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific ATT&CK technique is mapped from the available evidence.

Response

Fandango resolved the checkout issue, investigated with external specialists, enhanced protections and offered 24 months of credit monitoring. The notice does not identify a specific exploit or affected-person total. [1] See the notification.