{
  "id": "fandango-ticketing-checkout",
  "url": "https://ohshit.app/incidents/fandango-ticketing-checkout/",
  "title": "Fandango discloses possible payment card exposure on its ticketing checkout page",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-13",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Fandango",
    "Data breach",
    "Payment cards"
  ],
  "ecosystems": [],
  "summary": "Fandango found evidence that an unauthorized party could access payment card information tied to certain ticket purchases on its checkout page from October 8 to 11. The affected fields may include the full card number, security code, expiration date, billing ZIP code and email address.",
  "splash": "Customers who made affected transactions on Fandango's ticketing checkout page between October 8 and 11, 2026.",
  "wipe": "Check statements for the card used at checkout, contact its issuer about possible exposure and follow Fandango's notice if you received one.",
  "in_the_wild": "n/a",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify whether your purchase falls within the affected period",
      "hint": "Check your purchase history and the card used for Fandango ticket purchases from October 8 to 11. Confirm an unexpected notice through a known Fandango support channel or the sample published by California."
    },
    {
      "title": "Check the card and contact its issuer",
      "hint": "Review statements for unfamiliar charges and promptly report any to the issuer using the number on your card or its official app. Ask whether to lock or replace the card and set alerts for new transactions."
    },
    {
      "title": "Use the support described in your notice",
      "hint": "Fandango offers recipients 24 months of IDX monitoring. If you received a notice, follow Exhibit A and use its enrollment code by February 13, 2027. The published notice lists 1-866-200-0940 for questions and enrollment. Verify messages about your ticket purchases or the incident before sharing information."
    }
  ],
  "sources": [
    {
      "name": "Fandango customer notice filed in California",
      "url": "https://oag.ca.gov/system/files/Fandango%20-%20Individual%20Notice%20Template_Redacted.pdf",
      "says": "Describes the ticketing checkout issue, the affected window, the data fields and customer response.",
      "primary": true
    },
    {
      "name": "California Attorney General data breach register",
      "url": "https://oag.ca.gov/privacy/databreach/list",
      "says": "Lists November 13 as the reporting date and October 8 as the breach date.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": null,
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 8–11, 2026",
      "title": "Affected checkout transactions occur",
      "body": "The investigation later found evidence that an unauthorized party could access card details tied to certain transactions in this period."
    },
    {
      "date": "Oct 30, 2026",
      "title": "Fandango identifies potentially affected customers",
      "body": "The company determined that information belonging to the recipients of its notice may have been involved."
    },
    {
      "date": "Nov 13, 2026",
      "title": "California lists Fandango's notification",
      "body": "California publishes a sample customer letter."
    }
  ],
  "body_markdown": "Fandango says it investigated with outside cybersecurity specialists, resolved the checkout issue and enhanced its protections. It has disclosed the transaction window and the data that may have been accessible. The company has given no technical cause, evidence of a checkout skimmer or overall affected count. Fandango says it was unaware of fraudulent use resulting from this incident when it issued the notice.\n\nThe sample notice excludes names, government identifiers, Social Security numbers and other account information. This is rated L3 because it involves a widely used ticketing checkout and potential exposure of the full card details from some transactions."
}