ticketmaster data breach claim

Ticketmaster data breach could be tip of the iceberg

Ticketmaster was affected by a significant data protection breach after cybercriminals hacked the company’s website. However, it now looks like the number of people impacted by the theft is significantly worse than first thought.

What has happened so far?

A hacker group has accessed thousands of Ticketmaster customers’ payment details. Some customers of the ticket sales company have had their cards used fraudulently.

Investigating the Ticketmaster data breach, cybersecurity analysts RiskIQ have now identified the hacker group responsible for the malicious code placed on the Ticketmaster websites.

However, RiskIQ not only states that Magecart – a malicious hacking group – perpetrated the Ticketmaster attack, but that was also undertaking a massive credit card skimming operation that has affected over 800 e-commerce websites.

Worse, it appears that this hacking operation has been active since December 2016.

What is the extent of the problem?

It now looks likely that the Ticketmaster data theft was part of a larger credit card scheme. In fact, we could be looking at the biggest theft of credit card details to date.

According to RiskIQ, the hackers behind the attack “seem to have gotten smarter,”. And “rather than go after websites, they’ve figured out that it’s easier to compromise third-party suppliers of scripts and add their skimmer {code}. In some cases, compromising one of these suppliers gives them nearly 10,000 victims instantly.”

Put simply, Magecart could have stolen the credit card information of thousands of people across various websites, by merely targeting only a few companies. Some of the third-party companies allegedly compromised by Magecart include SocialPlus, PushAssist, Clarity Connect and Annex Cloud.

Ticketmaster uses SocialPlus. So, while Inbenta (a third-party software provider) has been established as the entry point for the malicious attack on its systems, at least one other source containing the skimmer had access to the Ticketmaster websites.

So, there could be a lot more to the recent Ticketmaster data breach than first thought.

What does this mean?

Because many shops use these third-parties, RiskIQ claims to have “identified nearly 100 top-tier victims, mainly online shops of some of the largest brands in the world.” It’s not yet clear which e-commerce sites have been affected.

Cyberthreat expert Ross Brewer has said that: “Third party data breaches are a growing problem for businesses. Hackers are persistent. They’re redirecting their attention to smaller, third-party suppliers that can act as a gateway to more lucrative targets. As the saying goes, you’re only as strong as your weakest link, which means if one of your third-party partners doesn’t have the same commitment to data protection, any tools you have in place are essentially rendered useless.”

What now?

There is more to this story than victims were initially told. And, while early estimates predict that 40,000 people in the UK have had their payment details swiped. It now looks likely that this number is much, much higher.

However, regardless of who was behind the attack, Ticketmaster was responsible for keeping your data safe, and this is something it has failed to do.

The Ticketmaster data protection breach has compromised customer names, addresses, email addresses, phone numbers, payment details and Ticketmaster login details. Data that can be used by cybercriminals to steal money from you, apply for credit in your name, set up fraudulent bank accounts and more.

So, if you have suffered damage or distress caused by this hack, you have a right to claim compensation. Ticketmaster has said that it has informed those involved, so if you have received this email let us know!

Data breaches often have severe consequences for those affected so you could be entitled to around £5,000 in compensation.

With data breaches on the rise, something has to be done to make big companies accountable for data losses, so claiming compensation isn’t just in your best interests, it could be the only way to ensure that businesses everywhere implement more secure processes.


cybercrime solicitors

Can you get your money back after a “push” fraud?

Last week, an article revealed the sad case of a widow who was conned into losing her mother’s care-home fees. In a highly-sophisticated cybercrime attack, the woman was defrauded of £20,000 in a so-called “push” scam.

What is push fraud?

Push fraud – also called authorised push payment (APP) scams – happen when criminals deceive individuals into sending them money. Because the victim believes the fraudster to be trustworthy and genuine, they authorise the handover of cash. The money is then quickly transferred by the fraudster to different accounts, often abroad, which makes getting it back almost impossible.

Common types of push payment scams include:

  • Sending falsified invoices that look exactly like ones victims are expecting (e.g. from a child’s school or a legitimate tradesperson)
  • Convincing people to transfer money to someone official, such as a solicitor (e.g. when buying a house)
  • Conning people to transfer cash into fraudulent bank accounts
  • Sending emails pretending to be from a friend asking for money.

While in many cases, the criminals involved might call hundreds of people in the hope of tricking someone, often these cybercrime scams are highly targeted and come after hacking a victim’s emails to identify the information needed to defraud them.

In this latest case, the criminal claimed to be from the Royal Bank of Scotland fraud team flagging up unusual transactions. The fraudsters ran through some security questions to extract the information they needed to access her online banking and rename her current account “frozen”. So, when the woman went to check via the proper channels, it did appear that her account had been locked. In a following call, she was then asked to move her balance to a new “protected” account. But when she called RBS to check the transfer went through okay, they knew nothing about it.

The rising problem of push fraud

The problem of transfer fraud is increasing in the UK. Indeed, according to consumer group Which? in the first two weeks after launching an online cybercrime reporting tool, more than 650 people came forward claiming a loss of over £5.5 million.

Overall, the latest official figures show that over £100 million was unknowingly handed over to criminals through push scams between January and June last year. Over this period around 17,000 people were victims of these scams, and they lost an average of £3,000 each.

How to protect yourself against push fraud

To keep you safe, UK Finance offers the following advice:

  • Never disclose security details such as your PIN or full banking password
  • Don’t assume an email, text or phone call is authentic
  • Just because someone knows some personal information about you (i.e. your mother’s maiden name), that doesn’t mean they are genuine
  • Banks or other trusted organisations will never contact you and ask for your PIN or full password, or ask you to transfer money to a safe account
  • Don’t be rushed into handing over sensitive information, take the time to contact the company directly using a trusted email or phone number to check the request is genuine
  • Listen to your instincts. If something doesn’t feel right don’t be pressured into making a decision there and then
  • Never automatically click on a link in an unexpected email or text.

Are the banks liable?

According to the banks, they make it very clear that customers should never make a payment at the request of someone over the phone or email. So, while millions have been lost by unwitting victims, because the transfers were authorised, until now banks have been unable (or unwilling) to return nearly 74% of the money.

Don’t be fobbed off by the banks!

If you have been the victim of a push fraud and need help getting your money back, there is some good news. Under new plans, the regulator is coming down on the side of consumers and people tricked into transferring money directly to a fraudster can expect stronger protections.

A new industry code will be in place from September, helping victims of such scams to secure compensation. What this means in practice is that victims of push scams can be confident that any claim for reimbursement will be given fairer consideration.

If you want to claim compensation following a push payment scam or another type of cybercrime, Hayes Connor can help. Our professional, friendly team will be pleased to answer any questions you might have, and advise you on whether you have a valid claim.

 We can help you to claim compensation from the fraudster, your bank, and any organisation that may have put your data at risk (where this data was then used to facilitate a push scam).

Start your claim


Facebook to alert you if your data was shared

From today, Facebook will begin notifying the 87 million people whose personal information may have been improperly shared with Cambridge Analytica.

If your data was leaked, you will receive a message from Facebook at the top of your news feed. This will provide details on how you are affected. You will receive this message if you or your friends used Facebook to log into the This Is Your Digital Life app.

Also, all other Facebook users will receive a notice helping them to turn off specific apps or shut down third-party access to their apps entirely.

While most of those affected are in the US, some people in the UK have also had their details breached. It is understood the messages will be sent out at about 5pm in the UK.

Take action now!

Facebook is now facing investigation both in the UK and the USA. If the social media giant is found to be in breach of the data protection act, you could be entitled to compensation.

It is important to stand up to big organisations who are exploiting our data. Particularly as this could just be the tip of the iceberg.


At Hayes Connor Solicitors, we are preparing a potential group action to take on the tech giant. Having already received ‘hundreds’ of enquiries from worried Facebook users across the country, we could be talking about one of the largest ever group actions of its kind in the UK courts.

If you are a Facebook user and are concerned that your data has been accessed and exploited, get in touch. We’ll let you know if and when you can claim.





facebook data

My data has been breached. What do I do?

My data has been breached… What do I do?

At Hayes Connor we deal with a number of cases where a clients data has been breached. In order to start a data breach claim we need to go through a number of details with you.

Each case is different as with any area of law but if you think that your data has been breached the first thing that we will ask is if you have reported this to the ICO?

The ICO is the body who will do an initial investigation on your behalf and then they may take action against the company who has commited the breach.

If you have been informed that you are informed that your data has been breached then you can make a claim for compensation – the Information Commissioner’s Office has issued information about what to do if you have been part of a breach.

ICO Guide for Data Breach and Cyber Crime – Click Here

You can also find information about what to do if your data has been breached as well being able to start your claim on our website

Click here 

Success Fees – FAQ’s


Success Fees are a mechanism by which a Solicitor will enter into an agreement with you for you to pay up to 25% of the damages you recover to that Solicitor in Costs. The Fee is only payable if the claim is successful and damages recovered. However, in some cases, your solicitor might charge a 0% success fee. This means you’ll receive 100% of any compensation awarded.


In the main, they mean that you will be paying part of your solicitor’s charges for running the claim for you. This being the case the Solicitor should account to you for the work they have done to justify charging the success fee. If they do not you may be able to challenge that fee.


In the main, because they are only entitled to fixed amounts of fees from Insurances companies who you are claiming against. This is the case for all Road Accident and Employer/Occupier or Public Liability claims with a value under £25,000 in damages.

Often the work that a solicitor will do for you in these cases will amount to a greater figure than the fixed costs available to them.


At all times a clear explanation of the fees they are going to charge you and why they are charging. They should be clear on the amounts, the timing of the payments and any other options you may have to fund that claim such as legal expense insurance you have already paid for elsewhere.


This is where you need to read the small print. There are many different approaches to the deduction of success fees and whether they include VAT, exclude VAT or have some element of administration charge or insurance product charge added. Always ask for a breakdown at the outset of how a fee is charged and an example.


Most Solicitors will not advertise their fee charges nor publish guidance on a website or other media for you to review. Always look at the No Win No Fee section of any material published and simply ask the question.

At Hayes Connor we work on a No Win No Fee basis and any success fee that is applicable will not exceed 25%. In some cases, particularly group actions, we offer 0% success fees.

cybercrime claims

Cyber Defamation

Have you been the victim of Cyber defamation? You can contact us to see if you may have a claim for compensation.

1. What is expression and defamation?

It is accepted in a democratic society that individuals have a right to express their own views and preferences. The Internet offers extensive potential for individuals and organisations to do this.

‘Defamation’, on the other hand, involves an abuse of freedom of expression whereby statements that may have a harmful impact on a person’s reputation are published.

Obviously it is important to ensure that unfounded claims should not be allowed to damage a person’s reputation, but it is also important for the law to balance such protections with the rights to freedom of expression that are a critical element of democratic societies. The issue of defamation has become a central issue in the use of the ‘Net because some corporations now use the threat of a legal action for defamation as a means to restrict the actions of groups or individuals campaigning against their activities. (See case study examples on notice and takedown).

2. How are defamation and freedom of expression covered by the law?

In the UK The Human Rights Act 1998 implements the European Convention on Human Rights (ECHR). Under the Convention:

  • The right to respect for an individual’s private and family life, home and correspondence is guaranteed under Article 8;
  • Rights of freedom of thought and expression are covered by Article 9;
  • Rights to freedom of expression and association are guaranteed under Articles 10 and 11.

These rights may have limitations put on them ‘as prescribed by law’ and which are ‘necessary in a democratic society’. The qualifications to these rights are the subject of continuing legal debate and case law.

The Defamation Act 1996 is the main UK law governing defamation. A defamatory statement can be published in:

  • Verbal form, when it is classed as slander – because only the spoken word is involved, slander can often be difficult to prove; or
  • Written form, when is classed as libel – a case for libel is easier to bring because evidence can be documented.

Material may have the potential to defame someone if:

  • The statement made would make an ordinary person modify their opinions of a person as a result of hearing or reading the statement.

Under UK law it is possible to defame corporations as well as individuals.
Defamation actions in relation to the Internet have so far involved libel. Libel must be widely ‘published’. You could libel someone using electronic networks by:

  • Sending an email, or an email attachment, where that email is widely posted or forwarded;
  • Making material available via a web page;
  • Posting to an email list or newsgroup; or
  • Streaming audio or video via the Net.

Anyone who actively transmits defamatory material is liable as part of any legal action. Most standard contracts for Internet services include conditions relating to defamation.

The 1996 Act creates a category of ‘special publisher’, where;

  • the material transmitted is passed automatically by electronic systems without their involvement; or
  • they are only the suppliers of the equipment or systems that enable publishing or distribution.

The Act also outlines the framework for prosecuting cases of alleged defamation, as well as various defences for anyone prosecuted along with the author of the material. To successfully defend against prosecution you must show that:

  • You were not the author, editor or publisher of the material;
  • That you had taken ‘reasonable care’ to prevent the publication of any defamatory material; and
  • That you did not know, or had reason to believe, that the material was defamatory, and that your transmission did not contribute to the construction of the defamatory material; or
  • The reputation of the ‘defamed’ person is such that the material could not conceivably change the average person’s views on them.

The current legal framework will probably be revised as part of new legislation for electronic commerce and electronic media.

If a person discovers that material that is damaging to their reputation is about to be disclosed, they could bring an injunction to prevent publication (on the basis of the damage it would cause, rather than on grounds of defamation). If the alleged defamatory material is already in the public domain, an injunction could be requested to force the removal or recall of the material before the case is heard.

3. How do defamation laws threaten civil liberties?

Companies and individuals may threaten a defamation action or use an injunction to silence their critics or campaigners. An injunction can be instantly actioned and prosecuted, regardless of whether it is justifiable. Given this, and the difficulty of fighting actions through the higher courts, some corporations have used injunctions rather than defamation actions to tackle problems with groups or campaigns.

Internet service providers, like other publishers, will not normally defend a claim of defamation. Rather than risk the costs of a legal action, many will simply remove the allegedly offensive material and undertake not to allow its future publication.

Filtering and blocking systems can be used in computers and Internet servers as a much simpler, and more effective, means for controlling access to material:

  • Filtering sifts packets of data or messages as they move across computer networks and eliminating those containing ‘undesirable’ material; and
  • Blocking prevents access to whole areas of the Internet based upon an address or location.

Concerns have been raised about the use of blocking and filtering software and the impact on freedom of expression. In the US, where such systems are widely used, a wide range of sites have been blocked; as well as those deemed ‘offensive’ because of their sexual or violent content, other sites seem to get blocked on the basis of their political content.

Filtering and blocking mechanisms are increasingly being used to control public access to sites critical of the state or status quo. Some states (such as China and Singapore) require the installation of this software, making it a form of indirect state censorship. Lists of blocked sites are usually protected under legal regulations on intellectual property, so it is difficult to have an informed debate about the civil liberties implications of such censorship.



What is No Win No Fee


A no win, no fee agreement is an arrangement between you and your solicitor. Also known as a Conditional Fee Agreement, if your claim is not successful, you won’t have to pay any money for the work carried out (providing you have not misled us).

No win, no fee agreements help people get the compensation and rehabilitation they need following an accident that wasn’t their fault.


From the very first time you speak to us, you’ll find us compassionate, friendly, and experienced. While each case is different, we can usually tell you straight away if you have a claim or not.

Once you have confirmed that you want to proceed on a no win no fee basis, we’ll remove the hassle and take care of all the complex legal work for you. And, because we want you to be able to get on with the rest of your life as soon as possible, a straightforward claim can be settled within as little as two to five months*.

Find out more about our hassle-free claims process. .


If your claim is successful (and that’s what we all want!), you’ll have to make a contribution to your solicitor’s costs. This ‘success fee’ is taken from the compensation awarded to you. The amount of the success fee depends on when your case is settled, but with us you’ll never have to pay more than 25% of your compensation.

Contact our expert personal injury specialists on 0330 995 0070 and start making your no win no fee compensation claim today.

There’s no obligation to proceed, and the call is completely confidential.



*More complex cases may take longer

What are No Win No Fee Agreements

data breach claims

Data breach compensation claims. Is your business protected?



With your confidential data one of your most valuable assets, and an estimated 1,266% jump in cyber fraud in 2016, it’s vital that your business is alive to the commercial consequences of breaching the personal data of your clients, employees, and competitors.


Under the Data Protection Act you must:

  • Use personal information fairly and lawfully
  • Collect only the information necessary for a specific purpose(s)
  • Ensure it is relevant, accurate and up to date
  • Only hold as much info as you need, and only for as long as you need it
  • Allow the subject of the information to see it on request
  • Keep all such data safe and secure.

In addition to protecting you from data breach compensation claims – and the financial implications associated with such actions – sound information management practices also make good business sense; boosting your reputation and increasing customer confidence.


As a very minimum, to ensure that your business is fully compliant with its data obligations, you need to consider:

  • Installing adequate firewalls
  • Regularly and routinely checking for viruses and malware
  • Ensuring all operating systems are updated and implemented regularly
  • Preventing staff members from sharing passwords
  • Encrypting personal data
  • Removing personal data from old computers
  • Identifying and recording what personal data is held and stored by the business
  • Making sure you have robust security systems in place to prevent data theft
  • Adding restrictive covenants into staff contracts (find out more about protecting your business from internal threats) {links to blog 22}
  • Establishing adequate policies to deal with issues such as marketing practices, social media use, and confidentiality
  • Making sure staff are trained and informed in matters relating to security and confidentiality
  • Establishing monitoring processes to detect any data breaches (and what you need to tell customers should the worst happen)
  • Liaising with the Information Commissioner’s Office (ICO) to develop and deploy compliant systems


To help you meet your obligations, download the ICO’s data protection self-assessment toolkit.



The ICO can issue an enforcement notice compelling a business to remedy a breach of the Data Protection Act. The sanction is made public, advertised on the ICO’s website, and carries significant harm to the reputation of the company concerned.

In addition to the issuing of an enforcement notice, the ICO can also issue financial penalties of up to £500,000. Recent fines against businesses include a telecommunications company being fined £440,000 for sending spam text messages, and an NHS Trust fined £325,000 for allowing the sensitive personal data of patients to be sold on eBay.

Stealing sensitive information is also a crime, so if a disgruntled or former employee of a competitor steals and then offers such info to you, the matter could be referred to the police. The  individual or company accused of stealing personal data could face criminal investigation and prosecution by the ICO, which leads, after conviction, to fines. If you obtained any financial benefits or competitive rewards because of stolen information, you may also be required to hand this back to the originating company.

The introduction of the General Data Protection Regulation (GDPS) from May 2018, will only serve to strengthen the powers of the ICO in combating data breaches. 

As such, we would recommend that all businesses be proactive in their relationships with the ICO, the public and their customer base in advance of this new regulatory regime. If they do not, an increase in fines from the regulator and an increase in civil claims will only cause long term economic difficulties to the business – as well harming its reputation in an ever increasing competitive marketplace.


Find out more about the data loss compensation process on our website

Alternatively, if your business has suffered a data breach due to the negligence or illegality of others, contact Hayes Connor Solicitors today.

Our initial evaluation is always free of charge, and there’s never any obligation to take things further.  With strict time limits in place for making most compensation claims, if you want to achieve maximum redress in the minimum amount of time, it’s important to act now.

data breach compensation

What To Do If Your Business Data Has Been Breached


Your company’s confidential data is one of its most valuable assets. Customer information databases, IP, trademarks etc. all help to give a competitive edge and can be the difference between success and failure.

The good news, is that data protection does not just apply to individuals and consumers. Businesses have rights too, and as such, where a mistake or other breach has occurred, companies can make a business data breach claim for compensation.


Businesses can protect themselves and their assets in a number of different ways. With prevention always better than cure. So, if you are entrusting your valuable data to a third-party, it always pays to make sure that they have adequate processes in place. At the very least this should include:

  • Secure firewalls
  • Anti-virus and anti-malware software
  • Regular and robust backup processes
  • A process for updating operating systems on a regular basis
  • Processes that prevent staff members from sharing passwords
  • Reliable encryption
  • Processes to remove outdated info
  • Processes to identify and record what personal data is held and stored by the business
  • Compliance with the Information Commissioner’s Office (ICO).

Of course, your own business should also adopt best practices when it comes to the above. 


What happens if a bank, financial institution or a trusted professional adviser of the business loses confidential data such as bank statements or financial material relating to the business?

Just like an individual, your business can pursue a claim for damages against the party who has either deliberately or negligently breached your confidential data.  

Due to the consequences of losing such information, the level of damages that may be awarded is likely to be substantial. Not just for the breach itself, but also to include the consequential damages and losses suffered by the business as a result.


“87% of employees take sensitive data with them when they leave a company, whether voluntarily or involuntarily.”

As well as protecting your business against external threats, you should also do everything you can to protect yourself from internal ones. This includes:

  • Making sure you have robust security systems in place to prevent data theft
  • Establishing monitoring processes to detect a data theft
  • Ensuring restrictive covenants are written into staff contracts. These prevent staff from sharing sensitive information once they have left your employ
  • Ensuring adequate policies are in place to deal with issues such as social media use
  • Ensuring these policies are communicated to employees.

However, stealing personal information is a crime, so if a disgruntled or former employee steals and then sells or misuses sensitive commercial information to obtain a financial benefit for themselves, or to provide a commercial advantage to a competitor, you can refer the matter to the police. You also have the right to criminally prosecute the individual in question.

In addition, where a theft has occurred you have the power to obtain injunctions to prevent the material being used or disclosed in the first instance, and thereafter you can apply to seize and obtain any financial benefits or rewards the employee or the competitor has achieved with the use of the information that was stolen.

Helping you to achieve the maximum amount of compensation, in the minimum amount of time, if your business has suffered a data breach due to the negligence or illegality of others, contact Hayes Connor Solicitors today.

Our initial evaluation is always free of charge, and there’s never any obligation to take things further.  Alternatively, you can find out more about making a business data loss compensation claim on our website. 

With strict time limits in place for making most compensation claims, if you want to achieve maximum redress in the minimum amount of time, it’s important to act now.