In a letter to Reg reader Mark, lawyers for the controversy-struck event ticket sales website said that Ticketmaster "is of the belief that it is not responsible for the Potential Security Incident".
They were referring to the June 2018 infection of its UK website with the Magecart payment credential-stealing malware. At the time, Ticketmaster publicly blamed "a customer support product hosted by Inbenta Technologies" for the infection. Inbenta chief exec Jordi Torras immediately hit back, telling us in June: "Had we known that script would have been used in that way, we would have advised against it, as it poses a security threat."
Our reader, who was travelling in the US when the Ticketmaster breach happened, found out that one of his bank cards was being used for unauthorised transactions in Belgium. After asking his bank to block it, Mark found that a second card had been blocked by Visa because of an "identity breach".
He told El Reg: "It's only the cards linked to my Ticketmaster account and used for purchases with them that were breached. I use the others for online and in-person purchases in various countries with no issues," adding that cards he had used with Amazon and Paypal were not compromised.
When he demanded compensation from Ticketmaster, lawyers from the Paul Hastings law firm wrote back to Mark (who showed us their letter) claiming that the ticket site was "currently undertaking an extensive investigation into the Potential Security Incident, and, in particular, its cause and the impact, if any, on customers and the privacy and security of their payment and other personal information".
They added that the breach "arose as a result of certain third party software infected with malicious code being served directly on our client's customers from third party servers; there was no security breach of our client's own servers and systems".
Ticketmaster failed to respond to multiple attempts by The Register to seek comment.
If all is as described by both Ticketmaster and Inbenta – noting that the former has not made public any details about precisely where the offending JS component was embedded – it is difficult to see how Ticketmaster could say it is not responsible for the breach while keeping a straight face.
The breach was plugged back in June, according to Inbenta, though details of transactions made between February and June were potentially exposed.
The summer Magecart outbreak was part of what seemed to infosec researchers to be a sustained and widespread campaign. Magecart's operators had switched from trying to directly infect individual websites to targeting and compromising widely used third-party webpage elements. BA and Sotheby's Home were also infected.