Ticketmaster has agreed to a $10 million criminal fine after federal prosecutors said the company used illegally-obtained passwords to hack into competitor CrowdSurge’s computer systems in order to hurt their business, according to the Department of Justice and news reports.
The massive fee is part of Ticketmaster’s deferred prosecution agreement to a five-count criminal investigation into computer intrusion and fraud offenses, according to a statement from the U.S. Attorney’s Office Wednesday.
The case stems from former employee Zeeshan Zaidi, the head of Ticketmaster’s Artist Services division, who in October 2019 pleaded guilty to charges of conspiring to commit computer intrusions and wire fraud in the scheme. Zaidi was the supervisor for Stephen Mead, a former CrowdSurge executive, according to news reports.
“Ticketmaster employees repeatedly – and illegally – accessed a competitor’s computers without authorization using stolen passwords to unlawfully collect business intelligence,” said Seth DuCharme, Acting U.S. Attorney for the Eastern District of New York, in the statement. “Further, Ticketmaster’s employees brazenly held a division-wide ‘summit’ at which the stolen passwords were used to access the victim company’s computers, as if that were an appropriate business tactic. Today’s resolution demonstrates that any company that obtains a competitor’s confidential information for commercial advantage, without authority or permission, should expect to be held accountable in federal court.”
A request for comment to Ticketmaster was not immediately answered Thursday. “Ticketmaster terminated both Zaidi and Mead in 2017, after their conduct came to light," Ticketmaster said in a statement emailed to Billboard. "Their actions violated our corporate policies and were inconsistent with our values. We are pleased that this matter is now resolved.”
While the DOJ did not identify the name of the competitor, numerous news reports have said it was DUMBO-based CrowdSurge, where Mead worked from 2010 to 2012.
CrowdSurge handled ticket sales for artists such as Alicia Keys, Arcade Fire, Jack White, Macklemore & Ryan Lewis, Paul McCartney and The xx, according to Crunchbase.
Mead, who was hired by Ticketmaster’s parent company Live Nation in 2013, a year after he left his job at CrowdSurge, retained information on accessing CrowdSurge’s internal drafts of ticketing web pages, the DOJ said.
Variety reported that “Mead had kept 85,000 company documents on his laptop computer after leaving his job as general manager of U.S. operations for CrowdSurge. Those documents included confidential business plans, strategic and financial information, contracts, client lists, and dozens of user names and passwords to confidential CrowdSurge tools.”
Despite having signed a separation agreement in which he agreed to maintain the confidentiality of CrowdSurge’s systems, Mead used his access to surveil their ongoing internal websites in order to “choke off” the competition, and to “steal back one of (their) signature clients,” according to the DOJ.
In 2014, Mead “emailed Zaidi and a second Ticketmaster executive multiple sets of usernames and passwords” to access one of CrowdSurge’s internal products. He “encouraged the executives to ‘screen-grab the hell out of the system,’ but also warned, ‘I must stress that as this is access to a live [victim company] tool I would be careful in what you click on as it would be best not [to] giveaway that we are snooping around,’” the DOJ statement said.
In 2014, a Live Nation senior executive asked Mead to use his access during demonstrations at a company meeting in San Francisco where, in front of at least 14 coworkers, Mead logged into the CrowdSurge systems with his retained username and password access, the DOJ said. Mead was promoted in 2015 and given a raise for his work.
CrowdSurge was merged with Songkick in 2015, ending Mead’s access to the internal systems, the Verge reported: “In 2017, Songkick sued Live Nation and Ticketmaster for violating antitrust laws. But it soon sold or shut down its services, and in 2018, it accepted a $110 million settlement — plus an undisclosed sum to sell some of its remaining assets to Ticketmaster.”
In addition to the criminal fee, under the terms of the deferred prosecution agreement Ticketmaster is also required to maintain a compliance and ethics program and report to the US Attorney’s Office for three years. If the company breaches the terms of the agreement, the US Attorney’s Office will move to prosecute Ticketmaster on various computer intrusion and wire fraud charges.
