Cybercriminals make more than $600,000 from stolen Taylor Swift concert tickets

11 March 2025 2 minutes Author: Newsman

Two people have been arrested in New York for a ticket fraud scheme involving Taylor Swift’s popular Elusive Tour. The attackers gained access to StubHub’s internal system and stole URLs for 993 tickets, which they sold for a total of more than $600,000.

Queens State Attorney Melinda Katz said that Tyrone Rose, 20, and Shamara Simmons, 31, were involved in the scheme, which involved StubHub’s Jamaica-based offshore contractor, Sutherland Global Services (SGS). who were arrested, the report said. After gaining access to the system, Rose and an unnamed accomplice discovered URLs for tickets that had already been sold but not yet shipped to customers. They forwarded those links to the email addresses of Simmons and another now-deceased accomplice. As a result, the scammers obtained 993 tickets from 350 orders and resold them on StubHub.

  • Most of them were tickets for Taylor Swift’s *Eras tour*, Adele and Ed Sheeran concerts, NBA games, and the U.S. Open. The proceeds amounted to approximately $635,000. StubHub discovered the scheme and reported it to SGS, the Jamaican police, and the Queens District Attorney’s Office. All of the SGS employees involved were immediately fired. Rose and Simmons are scheduled to appear in court on Friday, facing up to 15 years in prison for grand larceny, computer hacking, and conspiracy.

  • Taylor Swift concert tickets have been the target of numerous cybercrimes: in 2022, sales of the *Eras Tour* were paralyzed by bots that tried to bypass the queues of real buyers; in 2023, the barcodes of valid tickets to the singer’s concerts could have been leaked. StubHub and Ticketmaster regularly face similar attacks, trying to gain financial benefit from the promotion of major concert events. Conclusion

This incident is new evidence that cybercriminals are trying to make illegal money by exploiting the high demand for concerts of world stars. Ticket service organizers have no choice but to strengthen security measures to prevent such fraud from recurring.

Other related articles
News
Read more
Switzerland obliges critical companies to report cyberattacks within 24 hours
Switzerland will introduce a new law that will require important organizations to report cyberattacks within 24 hours. The changes will come into effect on April 1, 2025, and failure to comply after October 1 will result in fines of up to 100,000 Swiss francs. Read our article to learn more about how the reporting system works and what it means for business.
47
News
Read more
Lazarus group used 6 npm packages to steal developer logins
*Lazarus* hackers compromised 6 npm packages to steal developer logins and passwords. They used hidden code to collect data and send it to fake domains. The npm community has already eliminated the threat, but companies are advised to immediately update packages and change credentials. How the attack worked and how to protect yourself – read our article.
37
Found an error?
If you find an error, take a screenshot and send it to the bot.