The MLB Ballpark app, used by fans to store and manage game tickets, was targeted by bad actors exploiting leaked or stolen credentials from other breaches. Hackers accessed fan accounts, stole coveted MLB tickets, and forwarded them to unauthorized accounts for resale on third-party platforms. Victims included a Philadelphia fan who lost seven bachelor party tickets, later finding strangers occupying their seats, and an Illinois man who missed the first hour of a Cubs game due to vanished tickets. While MLB confirmed no breach of its own systems, the incident disrupted stadium entry for many, eroded customer trust, and highlighted vulnerabilities in digital ticketing platforms. Fraudsters capitalized on weak password hygiene and the high liquidity of live-event tickets, accelerating account takeovers. MLB responded with security updates, but the exploit underscored broader risks in the $12.5B+ fraud landscape, where credential stuffing and automated resale bots increasingly target high-demand markets. The league’s proprietary app—praised for features like facial recognition—ironically became a vector for fraud due to its seamless ticket-sharing functionality.

The MLB's facial recognition program, referred to as Go-Ahead Entry, has raised privacy and security concerns among fans and privacy advocates. The program allows for expedited entry into the stadiums for fans who opt-in by submitting a selfie via an app, enabling their faces to be matched at camera kiosks. While the technology is intended to enhance the event experience by reducing wait times, critics argue that it may contribute to increased surveillance and data security risks, despite assurances from the facial recognition company Wicket regarding data privacy and responsible use. The use of facial recognition is contentious, with potential for misuse or data breaches, prompting protests and skepticism about such systems' security measures.