Fandango discloses possible payment card exposure on its ticketing checkout page
Fandango found evidence that an unauthorized party could access payment card information tied to certain ticket purchases on its checkout page from October 8 to 11. The affected fields may include the full card number, security code, expiration date, billing ZIP code and email address.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Customers who made affected transactions on Fandango's ticketing checkout page between October 8 and 11, 2026.
- Fandango · Data breach · Payment cards
- In the wild
- Not applicable
What happened
Fandango says it investigated with outside cybersecurity specialists, resolved the checkout issue and enhanced its protections. It has disclosed the transaction window and the data that may have been accessible. The company has given no technical cause, evidence of a checkout skimmer or overall affected count. Fandango says it was unaware of fraudulent use resulting from this incident when it issued the notice.
The sample notice excludes names, government identifiers, Social Security numbers and other account information. This is rated L3 because it involves a widely used ticketing checkout and potential exposure of the full card details from some transactions.
Crime-scene timeline
Oct 8–11, 2026
Affected checkout transactions occur
The investigation later found evidence that an unauthorized party could access card details tied to certain transactions in this period.
Oct 30, 2026
Fandango identifies potentially affected customers
The company determined that information belonging to the recipients of its notice may have been involved.
Nov 13, 2026
California lists Fandango's notification
California publishes a sample customer letter.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Fandango customer notice filed in CaliforniaPrimaryDescribes the ticketing checkout issue, the affected window, the data fields and customer response.
- California Attorney General data breach registerPrimaryLists November 13 as the reporting date and October 8 as the breach date.