Original URL: http://www.theregister.co.uk/2014/05/09/moshtix_admin_account_popped_by_partypooper_skids/

Moshtix admin account popped by party-pooper hipster-hating hacker

422 big spenders thought huge $1,000 festival fees were par for the course

By Darren Pauli

Posted in Security, 9th May 2014 15:15 GMT

Skiddies logged into a staff account of Aussie ticketing outlet Moshtix and caused havoc for fans snapping up tix.

Punters who were in line for $355 pre-sale tickets for the hippy hipster-favoured Splendour in the Grass festival in Byron Bay had a rude shock when their online checkout totals were up to 1,000 per cent more expensive than expected.

Hackers had set ticket prices and credit card fees to the tune of thousands of dollars, forcing scores of would-be partygoers to either cough up and pay, or miss out.

Moshtix refunded money to 422 people, who paid the exorbitant fees (those set by the miscreants, rather than the organisers), and issued more tickets for the sold-out fest.

Boss Harley Evans said his biz did not know how the credentials for the compromised admin account, set up specifically for the hipster event, were obtained, but said the breach was not due to software bugs being exploited.

"The unauthorised access was limited to the front-end area of our system that controls event configuration information for the Splendour in The Grass event (such as ticket prices, ticket fees, [and] event info for the website)," Evans wrote in an advisory.

"Our view is that it appears from the actions that the intention was to create confusion and concern and damage the Moshtix brand."

Moshtix has informed state cops, and intends to pursue the hackers "to the fullest extent possible". Evans apologised for the hippy-hating hack, and said punters should keep an eye out for fresh tickets for the festival on the site. ®