November 2022. Taylor Swift announces the Eras Tour — her first concert tour in five years. Ticketmaster runs a “Verified Fan” presale designed to prioritize real fans over scalpers. 14 million people register. 3.5 million receive presale codes.
On sale day, Ticketmaster’s systems are overwhelmed — not by fake traffic, but by bots completing the legitimate ticket purchase flow. Bots held millions of tickets simultaneously in shopping carts, preventing real fans from accessing inventory. Ticketmaster’s queue system collapsed. Millions of verified fans waited hours in queue only to find no tickets available.
The sale was cancelled for general public. Tickets that did reach the market appeared on resale platforms for thousands of dollars above face value within hours.
The scale of the failure was large enough that the US Senate Judiciary Committee held hearings on bot abuse, ticket monopolization, and Live Nation’s market position. Ticketmaster’s CEO testified. Multiple pieces of anti-bot legislation were introduced.
The bots didn’t hack Ticketmaster. They used the ticket purchase API exactly as designed — they just did it thousands of times per second, with no limit on how many carts any session could hold simultaneously.
No credential theft. No SQL injection. No unauthorized endpoint. The bots called the exact same API every fan used — just faster, from more sessions, holding more inventory than any business rule prevented. The API had no concept of “too much business activity.”