Fanpass fanpass.co.uk Fanpass data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Fanpass, a UK site for buying and selling football tickets, suffered a breach in April 2022. It exposed 112,251 accounts: names, phone numbers, addresses, purchase histories and salted password hashes.
View all 13,118 breaches- Breach date
- 30 Apr 2022
- Affected
- 112,251
- Data exposed
- Email addresses, Genders, Names, Partial dates of birth, Passwords, Phone numbers, Physical addresses, Purchases, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Fanpass, the UK website for buying and selling soccer tickets, suffered a data breach in April 2022. Have I Been Pwned (HIBP) counts 112,251 accounts and says the exposed data included names, phone numbers, physical addresses, purchase histories and salted password hashes. HIBP added the breach on 24 May 2022 and links to an incident notification that Fanpass sent to customers.
What was exposed
HIBP lists email addresses, genders, names, partial dates of birth, passwords, phone numbers, physical addresses, purchases and social media profiles. The passwords were stored as salted hashes, so they weren't in plain text.
What that lets criminals do
A name, home address, phone number and a record of which matches you bought tickets for is ideal for phishing. A message that mentions a fixture you really attended, or a refund for tickets, is easy to believe. The phone number also allows text message scams. The email and password pair is useful for credential stuffing, where criminals try the same login on other sites, so a reused password is the biggest practical risk.
What to do now
Change your Fanpass password and anywhere you reused it. Turn on two-factor authentication where it's offered. Be careful with emails and texts about tickets, refunds or resales. If you think you've been targeted, you can report it to Action Fraud in England, Wales and Northern Ireland, or Police Scotland in Scotland.
Sources checked: haveibeenpwned.com, milled.com, ncsc.gov.uk
Last verified against the official page:
What to do if you were in it
- 1
Change your Fanpass password and any reused one
The NCSC recommends three random words for a strong, memorable password, and a different one for each important account: NCSC password advice.
- 2
Turn on two-factor authentication
Where a site offers it, use 2-step verification so a stolen password isn't enough. See CISA's guide to MFA or the NCSC's advice.
- 3
Be careful with ticket and refund messages
Expect phishing that mentions tickets, fixtures or refunds. Don't click links in them. See the NCSC on phishing. Report scams to Action Fraud.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan of your email and phone number against breach databases and the dark web. If something turns up, it alerts you and tells you what to do next. Serus can't remove data that has already leaked, but it can tell you which of your accounts are exposed. Run a free scan.
Frequently asked
Was I affected by the Fanpass data breach?
If you had a Fanpass account around April 2022, your details may be among the 112,251 accounts HIBP lists. Search your email on HIBP or run a free Serus scan.
What data was exposed in the Fanpass breach?
Email addresses, genders, names, partial dates of birth, passwords (salted hashes), phone numbers, physical addresses, purchases and social media profiles, according to HIBP.
Should I change my password?
Yes, on Fanpass and on any site where you used the same password. Then turn on 2-step verification where you can.
Sources
- Have I Been Pwned: Fanpass
- Have I Been Pwned: Fanpass Data Breach · haveibeenpwned.com
- We paused this request · milled.com
- Top tips for staying secure online | Three random words · ncsc.gov.uk
- Phishing scams: how to spot and report them · ncsc.gov.uk
- UK's Home for Reporting Cyber Crime & Fraud · actionfraud.police.uk
- Turn On MFA | CISA · cisa.gov
Something wrong or out of date? Tell us and we'll re-check it.
