For: customers who bought tickets on Fandango's online checkout and received a notice, or who paid there in early October 2026. This article is based on the notice Fandango filed with the California Attorney General and does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
customers who bought tickets on Fandango's online checkout and received a notice, or who paid there in early October 2026.
- Confirmed so farSee the table ↓
- Unauthorized party able to access card data on the checkout page
- Issue on the checkout page
- 24-month monitoring offer
Listed as possibly affected
- Payment card number, CVV, expiration date, billing ZIP
- Email address
- Not yet confirmed
- The number of affected people (not stated)
- The cause of the issue on the checkout page (the notice says only that it was resolved)
- Whether customers outside the United States are affected (not stated)
1 more
- Whether the company will publish an announcement of its own (we found none)
- What to do nowSee the steps ↓
- Find out whether you were in the date range
- Check your card statements and tell the issuer about charges you do not recognize
- Ask your card issuer whether to replace the card
2 more
- Use the free monitoring if your notice includes it
- Be careful with messages about this incident
- Where to verify (source)All sources ↓
- Fandango Media, LLC, "Notice of Data Breach" (sample individual notice filed with the California Attorney General; checked November 15)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The notice says Fandango resolved the issue and further enhanced its processes and protections, and that it is not currently aware of fraudulent use of the information. It does not say whether more will be published. We checked the California Attorney General's list on November 15 and found one entry for Fandango Media, LLC.
What to do today
Find out whether you were in the date range
The notice covers transactions on Fandango's ticketing checkout page from October 8 to 11, 2026. Look at the cards you use for tickets and see whether any payment around those dates was on Fandango. Customers who may have been impacted appear to be notified by email (the sample is in email form). Check your inbox and spam folder for a message titled "Fandango - Notice of Security Incident". If you cannot tell, treat any Fandango card payment in that window as possibly impacted.
Check your card statements and tell the issuer about charges you do not recognize
The notice's own advice is to review your credit reports and financial accounts for suspicious activity and promptly report any unauthorized transactions to your card issuer or bank. Look at small charges as well as large ones. Many card issuers also let you turn on transaction alerts in their app.
Ask your card issuer whether to replace the card
The card number, CVV and expiration date are all listed. Together those are what is needed to pay online with a card, so ask the issuer whether it recommends a new card number (our advice, not the company's). Ask when the issuer will start sending you the new card, and update any subscription or app that stores the old number.
Use the free monitoring if your notice includes it
The notice offers 24 months, at no cost, of credit monitoring (single bureau, adults), dark web monitoring, an identity theft insurance policy reimbursing recovery expenses (up to 1,000,000 dollars, subject to the policy terms) and managed identity theft recovery, through a monitoring-service provider. Sign up using the website or the phone number printed in your notice and the enrollment code in your own copy. The sample gives February 13, 2027 as the activation deadline. The service needs to be activated to work, and it requires established credit.
Be careful with messages about this incident
Your email address was among the information that may have been impacted. The company's notice does not ask for card details. Do not click links in unexpected messages that mention a breach, a refund or a card problem, and do not give a full card number, a CVV or a one-time code to anyone who contacted you first. If you are unsure, contact Fandango through its website that you open yourself, or use the call center number in the notice (1-866-200-0940). Our general advice on fake contacts is in What phishing is.
What happened (from Fandango's notice)
This section follows the notice Fandango filed with the California Attorney General (reported on November 13, 2026). It is the company's own account and has not been verified by a third party. We found no separate announcement on the company's site.
October 8 to 11
The period during which, according to the notice, an unauthorized party could access payment card information associated with certain transactions on Fandango's ticketing checkout page.October 30
Fandango determined that a given customer's information may have been impacted.November 13
The report date on the California Attorney General's list for Fandango Media, LLC, with a sample individual notice. The list shows October 8, 2026 as the date of the breach.February 13, 2027
The activation deadline for the monitoring offer in the sample notice.
- What happened (the company's words)
- An issue involving the ticketing checkout page. The company investigated with outside cybersecurity specialists and resolved the issue
- Information that may have been impacted
- Payment card number, CVV, expiration date, billing ZIP code, and email address
- Not involved (the company)
- First and last name, any government-issued identification information, Social Security numbers, and other account information
- Misuse
- The company says it is not currently aware of any fraudulent use of the information
- What the company did
- Resolved the issue, investigated with cybersecurity specialists, and further enhanced its processes and protections
- Monitoring offer
- 24 months, free of charge, through a monitoring-service provider: single-bureau credit monitoring for adults, dark web monitoring, an identity theft insurance policy reimbursing recovery expenses (up to 1,000,000 dollars, subject to the policy terms), and managed identity theft recovery. Activate by February 13, 2027 (sample)
- Contact
- Call center 1-866-200-0940, Monday to Friday, 6 a.m. to 6 p.m. Pacific Time, excluding US holidays
What is known and what is not
The state as of November 15, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Unauthorized party able to access card data on the checkout page | Certain transactions, October 8 to 11, 2026 | Confirmed (the company: could access) |
| Payment card number, CVV, expiration date, billing ZIP | Listed as information that may have been impacted | Possible (the company: may have been impacted) |
| Email address | Listed as information that may have been impacted | Possible (the company: may have been impacted) |
| First and last name | Not involved | Not included (the company) |
| Government ID information, Social Security numbers, other account information | Not involved | Not included (the company) |
| Fraudulent use of the information | The company is not currently aware of any | Not confirmed (the company) |
| Issue on the checkout page | Resolved | Confirmed (the company) |
| 24-month monitoring offer | Free; activate by February 13, 2027 (sample) | Confirmed (the company) |
| Number of affected people | Not stated | Not stated |
| Cause of the issue | Not stated beyond "an issue involving the ticketing checkout page" | Not stated |
| Customers outside the United States | Not stated | Not stated |
How to read this: the notice says information may have been impacted, not that every card was misused
The notice says an unauthorized party "could access" card information for certain transactions in a four-day window, and that the company determined a given person's information "may have been" impacted. It does not say how many cards were used, and it says the company is not aware of fraudulent use. A sample notice is also a template with the recipient's details left out, so we cannot tell which transactions or customers are covered.
How to read this: the company's account has not been verified by a third party
The notice rests on Fandango's own investigation with outside cybersecurity specialists, whose findings have not been published. We found no company announcement besides the notice filed with the state.
What can happen when card details are taken at checkout
This is what can happen in general, not a statement that it has happened here. The company says it is not aware of fraudulent use.
A card number, expiration date and CVV together are what a merchant needs to charge a card online, and a billing ZIP code is often asked for as well. That is why the first step is to watch statements and ask the issuer whether to replace the card. Charges made with stolen card details are often small test charges first. An email address on its own is enough to receive convincing fake messages that mention tickets, a refund or the incident itself.
What merchants can learn
The notice says the problem was on the ticketing checkout page and that the company resolved it. We do not know the cause, so we do not give advice about a specific flaw. From the facts alone, and as our view rather than an assessment of the company: the checkout page is where card numbers are typed in, so it is worth knowing exactly which scripts and third-party resources run on that page, who can change them, and how you would notice a change. Card data handled by a payment provider's own hosted fields stays out of reach of your own page. We do not describe the attack.
Sources (public records)
The facts in this article come from the public records below. Attack details are not covered.
- Fandango Media, LLC, "Notice of Data Breach" (sample individual notice filed with the California Attorney General; checked November 15) — oag.ca.gov (PDF)
- Fandango Media, LLC, data breach report page on the California Attorney General's site (date of breach October 8, 2026, reported November 13, 2026; checked November 15) — oag.ca.gov
- California Attorney General, "Search Data Security Breaches" (list entry for Fandango Media, LLC) — oag.ca.gov
Update history
2026-11-15: First version. Based on the sample individual notice Fandango filed with the California Attorney General (reported November 13). We found no separate company announcement. We will update when more is published.
Read next
- A card-data theft at a payment page: The PhotoGoods card data theft
- An online retailer's account breach with stored card details: The Revolve breach
- Fake messages after a breach: What phishing is
- Other 2026 incidents: Data breaches and cyberattacks of 2026