StubHub Account Takeover Led to Unauthorized PayPal Ticket Purchase, Author Says
Summary
A Huntress author reported an unauthorized ticket purchase through a StubHub account linked to PayPal. The author says PayPal refunded the charge and describes weak account-verification practices when contacting StubHub by phone.
Key points
- The author reported a $913.20 ticket purchase through their StubHub account, charged to a linked PayPal account and withdrawn from their bank account.
- The author said they had not been phished and had a strong password and two-factor authentication on PayPal, but the account-linking arrangement allowed StubHub purchases without additional PayPal authentication.
- According to the author, removing a linked PayPal account or credit card required contacting StubHub by phone.
- The author said StubHub support granted account access and disclosed saved information after asking only for an email address and ZIP code.
- StubHub declined to refund the charge, according to an email quoted in the article; PayPal later credited the author for unauthorized use.
- The author changed passwords, reviewed accounts, requested removal of payment methods, and asked StubHub to close the account.
- The article recommends account hygiene and enabling two-factor authentication where available.
Article Details
- Victim Organization
- Nicholas's StubHub account and linked PayPal account
- Incident Type
- Unauthorized access to a StubHub account used to make a ticket purchase charged to the account holder's linked PayPal account
- Incident Date
- 2016-04-05
- Disclosure Date
- 2016-04-06
- Operational Impact
- A $912.20 ticket purchase was made through the victim's StubHub account and charged to the linked PayPal account; PayPal later credited the account for unauthorized use. The article also describes weak phone-based account verification, but does not report confirmed exposure of personal data.
- Claim Status
- confirmed