Ticketmaster settles class action for 2018 data breach

Ticketmaster has reportedly reached a confidential settlement in the High Court group action brought against the firm by more than 1,000 people following a 2018 data breach.

We have been following this case carefully since the Information Commissioners Office (ICO) fined Ticketmaster £1.25 million in November 2020 in respect of the breach, which Ticketmaster appealed. The appeal was subsequently stayed pending the outcome of this separate group action brought by customers allegedly affected by the breach.

See our previous articles for more analysis of the initial fine and the stay:
> Ticketmaster is fined £1.25m for data breach
> Ticketmaster data breach fine – appeal stayed until 2023

The mass litigation was brought against Ticketmaster in respect of the same 2018 breach that reportedly resulted in over 40,000 UK citizens having their personal data leaked. The law firm representing the Claimants has reported that Ticketmaster has denied liability for the claims and the settlement was made on a no admission basis – the terms of the settlement otherwise remain confidential.

The mass action was due to be tried and managed with an on-going Part 20 claim and counterclaim between Ticketmaster and a third-party supplier, Inbenta Technologies, Inc. (Inbenta) that had provided the chat-bot software tool involved in the cyber-attack. It is currently unclear what will happen to those proceedings involving Inbenta now that settlement in this group action has been reached.

The initial stay of Ticketmaster’s ICO appeal was granted until 28 days after the handing down of the judgment in the High Court or of other events bringing an end to the proceedings. Therefore, it appears likely that the settlement will resume Ticketmaster’s appeal against the ICO’s 2020 decision. We imagine any lifting of the stay would be welcomed by the ICO, as the High Court proceedings were causing a lengthy delay in the ICO being able to recover any of the fine handed down (for which the ICO will seemingly still need to successfully defend Ticketmaster’s appeal).

Though we may now not see this data breach group action proceed through the courts and add to our understanding of the evolving landscape of class actions in the UK, what is clear is the continuing and complex impact of data breaches for impacted firms years after they occur.