Ticketmaster UK integrated Inbenta’s third-party customer support chatbot widget on their payment and checkout pages. The integration worked like most third-party JavaScript: Ticketmaster’s pages loaded a script tag pointing to a file on Inbenta’s CDN — <script src="https://inbenta.ticketmaster.net/...">. That script ran with full access to the page’s DOM, including any payment card fields the user was typing into.
Attackers — later attributed to Magecart Group 9 — compromised Inbenta’s CDN and modified the JavaScript file that Ticketmaster loaded. The modified script added a card-skimming payload that intercepted payment form submissions and exfiltrated card numbers, expiry dates, CVV codes, and billing addresses to an attacker-controlled server. The payload ran on Ticketmaster UK’s payment pages from February to June 2018 — four months.
Ticketmaster’s own payment processing was secure. Their API was not vulnerable. But they loaded a third-party script on their payment page and trusted that script implicitly — with no integrity verification, no monitoring for changes, and no sandboxing. The attacker didn’t break into Ticketmaster. They broke into a vendor Ticketmaster trusted, and used that trust as their entry point.