---
title: "Fandango checkout payment-data exposure"
description: "Fandango found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/fandango-checkout-payment-data-exposure-2026"
markdown_url: "https://www.ally.security/incidents/fandango-checkout-payment-data-exposure-2026.md"
stix_url: "https://www.ally.security/incidents/fandango-checkout-payment-data-exposure-2026/stix.json"
---

# Fandango checkout payment-data exposure

Fandango found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30.

Last modified Nov 14, 2026 · 1 source

## Summary

- **Environment:** Ticketing checkout page
- **Operational impact:** Personal-information access or exposure reported; disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Fandango](https://www.fandango.com/) found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30. [1](#source-1)

## Impact

Potentially involved data included card numbers, security codes, expiration dates, billing ZIP codes and email addresses. Names, government identifiers, Social Security numbers and other account information were excluded. [1](#source-1)

## Timeline

### October 30, 2026 — Personal-information impact determined

Personal-information impact determined. [1](#source-1)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

The checkout issue allowed unauthorized access to transaction information; the notice does not establish a specific vulnerability or malware family. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Fandango resolved the checkout issue, investigated with external specialists, enhanced protections and offered 24 months of credit monitoring. The notice does not identify a specific exploit or affected-person total. [1](#source-1) See the [notification](https://oag.ca.gov/system/files/Fandango%20-%20Individual%20Notice%20Template_Redacted.pdf).

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/fandango-checkout-payment-data-exposure-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Fandango Media, LLC security incident notice

official · Fandango Media, LLC

<https://oag.ca.gov/system/files/Fandango%20-%20Individual%20Notice%20Template_Redacted.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Fandango checkout payment-data exposure: Potentially involved data included card numbers, security codes, expiration dates, billing ZIP codes and email addresses. Names, government identifiers, Social Security numbers and other account information were excluded.
2. **Occurred At · 100% confidence · current**  
   Personal-information impact determined: 2026-10-30
3. **Began At · 100% confidence · current**  
   Fandango checkout payment-data exposure: 2026-10-08
4. **Ended At · 100% confidence · current**  
   Fandango checkout payment-data exposure: 2026-10-11
5. **Affected Organization · 100% confidence · current**  
   Fandango checkout payment-data exposure: Fandango Media, LLC
6. **Resulted In · 100% confidence · current**  
   Fandango checkout payment-data exposure: Fandango resolved the checkout issue, investigated with external specialists, enhanced protections and offered 24 months of credit monitoring. The notice does not identify a specific exploit or affected-person total.
7. **Resulted In · 100% confidence · current**  
   Fandango checkout payment-data exposure: Fandango found evidence that an unauthorized party could access payment-card information associated with certain ticket-checkout transactions during October 8–11, 2026. It determined personal-information impact on October 30.
8. **Resulted In · 100% confidence · current**  
   Fandango checkout payment-data exposure: Personal-information impact determined

</details>