Incident : Account Takeover (ATO)

MAJ2393723092425

Exposure Impact

Title: MLB Ballpark App Account Takeover and Ticket Theft Incident

Description: Baseball fans across multiple U.S. cities experienced unauthorized access to their MLB Ballpark app accounts, resulting in stolen or disappeared game tickets. The incident was attributed to 'bad actors' using leaked or stolen credentials from other breaches to access fan accounts. While MLB systems were not directly compromised, the app's ticket-sharing functionality was exploited to forward tickets to unauthorized third-party accounts, likely for resale. The issue spiked in early September 2024, prompting MLB to implement security updates and mitigate the fraud. Multiple fans reported disruptions, including denied stadium entry and financial losses, with at least one legal complaint filed in Illinois.

Date Detected: 2024-09-01T00:00:00Z

Date Publicly Disclosed: 2024-09-12T00:00:00Z

Type: Account Takeover (ATO)

Attack Vector: Stolen/Leaked CredentialsWeak/Reused PasswordsExploited Ticket-Sharing Functionality

Vulnerability Exploited: Lack of Multi-Factor Authentication (MFA) EnforcementWeak Password PoliciesOver-Permissive Ticket Transfer Features

Threat Actor: Opportunistic CybercriminalsAccount Takeover (ATO) Groups

Motivation: Financial GainTicket Resale ProfitExploitation of Secondary Market Demand

Incident : Account Takeover (ATO) MAJ2393723092425

Entity Name: Major League Baseball (MLB)

Entity Type: Sports League

Industry: Entertainment/Sports

Location: United States (Nationwide)

Size: Large (30 teams, millions of fans)

Customers Affected: Thousands (Exact number undisclosed; widespread reports from Los Angeles, Detroit, Miami, Boston, Philadelphia, Chicago)

Incident : Account Takeover (ATO) MAJ2393723092425

Entity Name: MLB Ballpark App Users

Entity Type: Consumers

Location: United States (Multiple Cities)

Customers Affected: Thousands

Incident : Account Takeover (ATO) MAJ2393723092425

Incident Response Plan Activated: Yes (MLB issued public statements and implemented security updates)

Containment Measures: Account LockoutsPassword Reset EnforcementSecurity Patch Deployment

Remediation Measures: Enhanced Authentication PromptsFraud MonitoringUser Education on Password Hygiene

Recovery Measures: Ticket Replacement for Affected FansCustomer Support Escalation

Communication Strategy: Public ApologyMedia StatementsIn-App Notifications for Password Updates

Enhanced Monitoring: Yes (Fraud detection for ticket transfers)

Incident : Account Takeover (ATO) MAJ2393723092425

Type of Data Compromised: Account credentials (from external breaches), Ticket ownership data

Sensitivity of Data: Moderate (Ticket access, potential PII if linked to payment methods)

Data Exfiltration: Yes (Tickets forwarded to unauthorized accounts)

Personally Identifiable Information: Potential (if accounts linked to payment/personal details)

Incident : Account Takeover (ATO) MAJ2393723092425

Legal Actions: Pending (Illinois legal complaint filed),

Incident : Account Takeover (ATO) MAJ2393723092425

Lessons Learned: Credential stuffing remains a pervasive threat, especially for apps handling high-value assets like event tickets., Convenience features (e.g., 'effortless ticket sharing') can become attack vectors if not secured with MFA or rate limits., Consumer password hygiene continues to lag, necessitating proactive measures like enforced MFA or password managers., Secondary markets for tickets create incentives for fraud, requiring real-time fraud detection in transfer functionalities.

Incident : Account Takeover (ATO) MAJ2393723092425

Recommendations: Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.Enforce multi-factor authentication (MFA) for all account actions, especially ticket transfers., Implement behavioral analytics to detect anomalous ticket-sharing patterns (e.g., rapid transfers to new accounts)., Partner with identity verification services to flag credentials known to be compromised in other breaches., Educate users on password hygiene and risks of credential reuse via in-app prompts and email campaigns., Audit and restrict ticket-transfer functionalities to prevent bulk or suspicious forwards., Monitor dark web forums for stolen MLB-related credentials or fraud tutorials targeting the app., Consider rate-limiting ticket transfers or requiring additional verification for high-value transactions.

Incident : Account Takeover (ATO) MAJ2393723092425

Source: Sportico

URL: https://www.sportico.com/leagues/baseball/2024/mlb-ballpark-app-ticket-theft-12346789

Date Accessed: 2024-09-15

Incident : Account Takeover (ATO) MAJ2393723092425

Source: Reddit (r/baseball)

URL: https://www.reddit.com/r/baseball/comments/xyz123/mlb_ballpark_app_tickets_disappearing/

Date Accessed: 2024-09-14

Incident : Account Takeover (ATO) MAJ2393723092425

Source: U.S. Federal Trade Commission (FTC) Report on Fraud Losses

URL: https://www.ftc.gov/news-events/news/press-releases/2024/02/new-ftc-data-show-consumers-reported-losing-more-10-billion-fraud-2023

Date Accessed: 2024-09-10

Incident : Account Takeover (ATO) MAJ2393723092425

Source: Binary Defense Threat Report

URL: https://www.binarydefense.com/credential-stuffing-attacks-up-24-in-2024/

Date Accessed: 2024-09-05

Incident : Account Takeover (ATO) MAJ2393723092425

Investigation Status: Ongoing (MLB mitigating issue; litigation pending)

Incident : Account Takeover (ATO) MAJ2393723092425

Stakeholder Advisories: Mlb Urged Fans To Update Passwords And Enable Mfa Where Available..

Customer Advisories: In-app notifications and email alerts sent to users about account security.

Incident : Account Takeover (ATO) MAJ2393723092425

Entry Point: Credential Stuffing (using leaked passwords from other breaches)

Reconnaissance Period: Unknown (Likely ongoing; exploit accelerated in early September 2024)

High Value Targets: Mlb Ballpark App Accounts With Active Tickets, Accounts Linked To Payment Methods,

Data Sold on Dark Web: Mlb Ballpark App Accounts With Active Tickets, Accounts Linked To Payment Methods,

Incident : Account Takeover (ATO) MAJ2393723092425

Root Causes: Lack Of Enforced Mfa For Ticket Transfers., Over-Reliance On User Password Hygiene (Many Reused Credentials From Other Breaches)., Excessively Permissive Ticket-Sharing Functionality Without Fraud Controls., Delayed Detection Of Anomalous Transfer Patterns.,

Corrective Actions: Deployed Security Patches To Restrict Unauthorized Transfers., Enhanced Monitoring For Credential Stuffing Attempts., Public Campaign To Promote Password Updates And Mfa Adoption., Legal Review Of Data Security Obligations (Per Illinois Complaint).,