Thieves accessed more than 1,000 customer accounts on StubHub and used them to purchase tickets to popular events, from Justin Timberlake and Jay Z concerts to Yankees baseball games, the New York County District Attorney said today, announcing the arrest and indictment of six individuals in connection with the crimes.
As Reuters and the Associated Press originally reported, the thieves acquired StubHub user account details from breaches on other websites. They were then said to have turned around and used those accounts to fraudulently purchase e-tickets, a scam that defrauded StubHub of $1 million, according to the District Attorney. StubHub was able to detect the unauthorized transactions and refund them last year.
Reuters reports that StubHub has been working on the case with authorities for around a year, and that StubHub's communications chief says that authorities found the perpetrators to be a "pretty intense network of cyber fraudsters working in concert with each other." Despite StubHub being a major target of the fraud ring, it's reported that no data was stolen from StubHub's own website — the breaches were made possible using information they allegedly stole elsewhere.
This post was updated after publication to include details of the indictment unsealed by the New York County District Attorney.