ANN ARBOR, Mich. (WXYZ) - Anyone who purchased tickets at the Michigan Union Ticket office between 2011 and 2013 could have had their information compromised.
A breach into the system was detected at the end of April by Vendini, the company which handles credit card transactions at the ticket office.
It is believed the system was hacked in September of 2011.
A school spokesperson told 7 Action News there are more than 33,000 customers affected.
Vendini released a statement saying there is a full-scale investigation under way with outside computer forensic and cyber security experts.
The company said it is conducting its own internal investigation.
It is believed in late March a third party tried to hack into the system and may have stolen email addresses, mailing addresses, credit card information and much more.
Vendini urges anyone who bought tickets from the box office during that time to review their bank statements.
A U of M spokesperson says the university is still using Vendini at this time and is speaking to the company to ensure this problem never happens again.
Below is a statement from Vendini:
We regret to inform you that on April 25, 2013, Vendini, Inc. detected an unauthorized intrusion into its systems. Vendini provides box-office and online ticketing services to hundreds of Vendini members, which include tour, casino, sports, arts, and entertainment venues and promoters across the U.S. and Canada. If you used a credit card to make a purchase for an event through Vendini's services, then your personal information may have been involved in this incident. For more information, please contact us at the number provided at the end of this posting.
We are actively cooperating with federal law enforcement, and this posting was delayed specifically to support law enforcement's investigation.
A full-scale, internal investigation is under way at Vendini with outside computer forensic and cyber security experts. Although our internal investigation is ongoing, we believe that in late March, a third-party criminal actor used hacking technologies to access our databases and may have accessed personal information, such as name, mailing address, email address, phone number, and credit card numbers and expiration dates that belong to our members' consumer-patrons. It is important to note we do not collect credit card security access codes (e.g., CVV, CVV2, PINs), information that is typically needed to complete a credit card transaction. Consumer-patron usernames or passwords were not accessed by the intruder.
Upon discovering this intrusion, we engaged computer forensic and cyber security experts to commence an investigation. We implemented enhanced security measures designed to prevent a recurrence of this type of incident. We notified our merchant banks; and credit card companies have been alerted. To protect against the possibility fraud, we urge all of our members' consumer-patrons to remain vigilant, to review credit card account statements and to monitor credit reports for any unauthorized activity. In addition:
• Do NOT respond to any requests for sensitive personal information in relation to this incident. Vendini will never request such information via email or telephone unless it is absolutely necessary to respond directly to a member or members' consumer-patrons regarding how this incident may have impacted them.
• In order for consumer-patrons to protect against the possibility of unauthorized use of your credit card, we encourage you to regularly review your credit card account statements for any unauthorized activity.
• If any consumer-patron suspects that he or she may be a victim of fraud, we recommend immediately contacting local law enforcement, the State Attorney General's offices and the Federal Trade Commission. We are making available a Resources Guide here for further information that may be of assistance.
Our business is built on our ability to provide trusted services to our members and their consumer-patrons. This trust is founded on data protection and privacy, which is our highest priority. We want to see those involved in this incident found and fully prosecuted.
Vendini took immediate steps to correct the problem and ensure the safety of patron information, and we will continue to provide all services without interruption. We are committed to protecting our members and their consumer-patrons. We will work diligently to maintain your trust and confidence in our company and services.
• If you are a consumer-patron, and you wish to learn more about this incident, please click here or contact us toll-free at 1-800-836-0473.
• If you are a Vendini member, please contact your member advocate, or contact us toll-free at 1(800) 901-7173.