The Ticketmaster data breach lawsuit is a consolidated federal class action moving through the U.S. District Court for the District of Montana, and as of mid-2026 there is no settlement, no claims process, and no payout available to affected customers. The case, part of a larger multidistrict litigation over a 2024 attack on the Snowflake cloud platform, cleared major hurdles in late 2025 when the judge refused to dismiss it and rejected the defendants’ push to force claims into arbitration. It is now in pretrial discovery.
Who Was Affected
Between April 2 and May 18, 2024, attackers gained access to a Ticketmaster customer database hosted on the third-party cloud platform Snowflake. The hacking group ShinyHunters later advertised records for 560 million customers for sale on a dark web forum, asking $500,000 for the roughly 1.3 terabytes of data.
The exposed information included names, email addresses, phone numbers, physical addresses, ticket purchase histories, order details, and partial credit card information such as the last four digits and expiration dates. Ticketmaster’s notification letters, sent starting in late June 2024, stated the breach affected customers who had purchased tickets to events in North America — the United States, Canada, and Mexico.
Affected customers were offered 12 months of free identity monitoring through TransUnion’s “My True Identity” service. That offer, which required an activation code from the notification letter and the last four digits of the recipient’s Social Security number, remains the only remedy Ticketmaster has provided to date.
Where the Lawsuit Stands
On October 4, 2024, the Judicial Panel on Multidistrict Litigation consolidated the growing pile of federal cases into a single proceeding, In re: Snowflake, Inc., Data Security Breach Litigation, MDL No. 3126, before Judge Brian Morris in the District of Montana. The MDL covers claims against Snowflake and several of its corporate clients, including Ticketmaster, Live Nation, AT&T, Advance Auto Parts, Neiman Marcus, and LendingTree.
Ticketmaster moved to dismiss the consumer plaintiffs’ third amended complaint on August 15, 2025. After a full-day hearing on October 6, 2025, Judge Morris denied the motion in an order dated October 28, 2025. The court found plaintiffs had shown concrete injuries — actual or attempted fraud on their accounts, mitigation costs like credit monitoring, diminished value of their personal information, and loss of the benefit of their bargain with Ticketmaster. Applying Montana’s foreseeability standard, the court held the defendants had a duty to provide reasonable security measures such as multi-factor authentication, and that the hackers’ criminal acts did not break the chain of causation because those acts were themselves foreseeable given the alleged security failures.
Two days later, on October 30, 2025, Judge Morris rejected bids by Snowflake, Ticketmaster, and LendingTree to force the consumer claims into arbitration. The consolidated case is proceeding in federal court.
What Plaintiffs Are Alleging
Complaints across the MDL accuse Ticketmaster, Live Nation, and Snowflake of failing to safeguard personal information, failing to implement adequate security, and failing to provide timely notice. A central allegation is the failure to require multi-factor authentication. According to plaintiffs, Snowflake’s default settings left MFA off, Ticketmaster never enabled it, stale credentials were left active, and access was not restricted by trusted IP addresses. The attackers, plaintiffs allege, got in using stolen login credentials from a former Snowflake employee’s demo account that lacked MFA.
One of the earliest Ticketmaster-specific suits, Pomeroy et al. v. Ticketmaster, was filed October 11, 2024, in the Central District of California and alleged negligence, negligence per se, unjust enrichment, and breach of implied contract, seeking at least $5 million in damages. Some plaintiffs frame their claims on a “benefit of the bargain” theory: the service fees they paid included an implicit promise of secure data handling that Ticketmaster did not deliver. Others allege fraudulent charges, spam calls and messages, out-of-pocket credit monitoring costs, and emotional distress.
Ticketmaster and Live Nation continue to contest the claims and deny wrongdoing. Snowflake has denied that the breach resulted from any vulnerability or misconfiguration in its platform, and investigations by CrowdStrike and Mandiant found the attackers exploited compromised customer credentials rather than a platform-level flaw.
Is There a Settlement to Claim?
No. As of mid-2026, no settlement has been reached, proposed, or approved in the Ticketmaster and Live Nation track of the litigation. There is no active claims process, no settlement fund, and no deadline to file. Any offers, forms, or websites claiming otherwise for Ticketmaster customers do not reflect the current docket. The only remedy provided so far remains the 12 months of TransUnion identity monitoring offered in 2024.
What Other Snowflake-MDL Settlements Have Looked Like
Two other defendants in the same MDL have settled, and their terms give a rough sense of the shape these deals take, though the Ticketmaster class is far larger than either.
Advance Auto Parts reached a $10 million settlement covering approximately 2.3 million affected individuals. Judge Morris granted final approval on October 23, 2025. Class members could choose up to $5,000 for documented losses, two years of credit monitoring, or an estimated $100 cash payment.
Neiman Marcus settled for $3.5 million, with preliminary approval on May 22, 2025. That deal offered up to $2,500 per person for documented expenses plus two years of credit monitoring. In both settlements, the claims against Snowflake were dismissed with prejudice.
The Ticketmaster figures, if it settles, would sit in a different range. The Advance Auto Parts class was 2.3 million people; Ticketmaster’s exposed records were advertised at 560 million.
Canadian Customers
Canadian consumers are not covered by the U.S. MDL. Consumer Law Group filed a class action in Quebec on October 7, 2024, on behalf of affected Canadian Ticketmaster customers, alleging the company failed to protect their personal information.
A separate Quebec class action, filed in August 2024 by Paquette Gadler on behalf of plaintiff Felipe Morales, is not about the breach at all. It challenges Ticketmaster’s service fees as “abusive” under Quebec’s Consumer Protection Act and Civil Code. On January 5, 2026, Justice Eleni Yiannakis of the Quebec Superior Court authorized that class action to proceed to trial, certifying a class of Quebec residents who purchased Ticketmaster tickets for North American events since July 2021.
What Affected Customers Can Do Now
If you received a notification letter in 2024 and have not enrolled in the offered TransUnion identity monitoring, you can still do so using the activation code from the letter. There is nothing to file in the class action itself right now: the case has not been certified as a class, no notice has gone out to class members, and no claims process exists. Updates on the consolidated case can be tracked through the District of Montana’s docket for MDL No. 3126.