Fandango Data Breach 2026, Credit Card Details Exposed, Who Is Affected and What to Do

Fandango Media, LLC is notifying movie-ticket customers that an unauthorized party may have accessed payment-card details tied to certain transactions on its online ticketing checkout page between October 8 and October 11, 2026. The details that may have been exposed are the card number, CVV security code, expiration date, billing ZIP code and email address.

Fandango says it determined on October 30 that customers’ information may have been affected, that it fixed the issue, and that it is not aware of fraudulent use so far. It has not published how many customers were affected. Notified customers get 24 months of free IDX identity protection, and the enrollment deadline is February 13, 2027.

No class action, putative class action or settlement has been verified for this breach, and no cash payment has been announced.

Fandango Data Breach 2026: Quick Facts

Detail	Confirmed information
Company	Fandango Media, LLC
Incident	Unauthorized access involving the online ticketing checkout page
Potential exposure dates	October 8 to 11, 2026
Fandango determined impact	October 30, 2026
Data that may have been exposed	Card number, CVV, expiration date, billing ZIP code, email address
Names exposed?	No, according to Fandango
Social Security numbers or government IDs exposed?	No, according to Fandango
Nationwide affected total	Not disclosed
Fraudulent use identified by Fandango	None so far
Free protection	24 months of IDX identity protection
Identity-theft insurance	Up to $1,000,000, subject to policy terms
Enrollment deadline	February 13, 2027
Helpline	1-866-200-0940 (Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays)
Class action or settlement	None verified for this breach

Primary source: Fandango’s individual notice filed with the California Attorney General (PDF)

What Happened in the Fandango Data Breach?

The incident involved the part of Fandango’s website where customers enter payment details to buy tickets. Fandango’s notice says investigators found that an unauthorized party could access payment-card information tied to certain transactions from October 8 through October 11, 2026. Fandango worked with outside cybersecurity specialists, says it resolved the issue, and says it has strengthened its protections. On October 30 it determined that information belonging to the people it is notifying may have been affected.

The notice does not explain how the attacker got in.

Was Fandango hit by checkout skimming malware?

This kind of incident resembles online card skimming, where an attacker captures payment details as a customer types them at checkout. But Fandango has not named any malware, malicious script, or compromised payment processor. Reporting it as confirmed skimming would go beyond what Fandango has said. What is established is that payment-card data tied to certain checkouts could be accessed during the four-day window.

What Information Was Exposed in the Fandango Breach?

Information	Why it matters
Payment-card number	Can be used to attempt unauthorized transactions
CVV security code	Often required for online purchases made without the physical card
Card expiration date	Another detail asked for at checkout
Billing ZIP code	Used in some address-verification checks
Email address	Can be used for phishing or impersonation

The combination is the concern. A valid card number, expiration date and CVV together can let someone try online purchases without the card. Banks and card networks run their own fraud detection, so exposure does not mean fraud will succeed.

What was NOT exposed?

Fandango says first and last names, government-issued ID, Social Security numbers and other account information were not involved. The notice does not say Fandango account passwords were exposed. A card-data breach is a different and generally lower identity-theft risk than a breach of Social Security numbers.

Who Is Affected by the Fandango Data Breach?

The people most at risk are customers whose payment details were processed through Fandango’s online checkout between October 8 and October 11, 2026. Check if you:

• Bought movie tickets on Fandango’s online checkout during those dates with a credit or debit card.
• Received a Fandango security incident notice.
• Saw an unfamiliar charge after a purchase in that window.

Fandango describes access to “certain transactions,” so a purchase on those dates is a reason to check, not proof your data was taken.

Bought on October 10 for a movie showing October 15? The relevant date is when you paid at checkout, not the showtime. That purchase falls in the window.

Paid at the theater box office? Fandango’s notice identifies its online ticketing checkout. It does not establish that in-person purchases at independent theaters were affected, or that every gift-card, digital-wallet or third-party transaction was.

Live outside California? The notice was filed with California’s Attorney General, but the incident concerns Fandango’s checkout system, not California residents only. Fandango has not released a state-by-state breakdown, so a California filing does not mean only Californians were affected.

Should You Replace Your Credit or Debit Card After the Fandango Breach?

If you bought tickets on Fandango’s checkout during October 8 to 11, call your card issuer and ask whether it recommends a new card number. Because the card number, expiration date and CVV may have been exposed together, asking for a replacement is a reasonable precaution. You generally do not need to close the account to get a new number.

1. Review recent transactions, including small unfamiliar charges.
2. Call the number on the back of your card or use your bank’s official app.
3. Tell the issuer Fandango reported possible card exposure on October 8 to 11.
4. Ask whether it has already flagged or blocked suspicious activity.
5. Request a new card number if recommended, and turn on transaction alerts.
6. Update any legitimate recurring payments after the new card arrives.

If your card was already replaced after October 11, the old number is less useful to an attacker, but still check your statements for earlier activity.

Related article: Acima $183.5 Million Settlement, Who Qualifies for Refunds, Debt Forgiveness and How Payments Work in 43 States

How to Dispute Unauthorized Charges After the Fandango Breach

If you see a charge you did not make, call your card issuer right away. You do not have to prove Fandango caused it before you report it.

	Credit card	Debit card
Main federal law	Fair Credit Billing Act (15 U.S.C. § 1666) and Regulation Z (12 CFR §§ 1026.12 and 1026.13)	Electronic Fund Transfer Act (15 U.S.C. § 1693 et seq.) and Regulation E (12 CFR § 1005.6)
Your liability for unauthorized use	Capped at $50 by law; generally $0 when only the card number was used	$0 to $50 if reported within two business days of learning of a lost or stolen card; up to $500 after that; potentially more if you miss the 60-day window
Reporting deadline	Written billing-error notice within 60 days after the statement showing the charge was sent	Report within 60 days after the statement showing the transfer was sent
Bank’s investigation	Acknowledge within 30 days; resolve within two billing cycles, no more than 90 days	Generally 10 business days, extendable up to 45 days if the bank issues provisional credit

Major card networks also advertise zero-liability policies. Those are company policies, not federal law, and their terms differ by issuer.

Credit card holders: When only the account number is stolen and you still hold the card, federal law generally leaves you with no liability for unauthorized use. Call the issuer, then send a written dispute within 60 days.

Debit card holders: Debit fraud takes money straight out of your bank account, so act fast. If the physical card was not lost or stolen, the 60-day statement rule is the key deadline, and delays can increase what you lose on later unauthorized transfers.

See the CFPB’s instructions for unauthorized transactions.

How to Enroll in Fandango’s Free IDX Credit Monitoring

Notified customers can get 24 months of IDX identity protection at no cost.

1. Find your Fandango notice and the unique IDX enrollment code in it.
2. Go to the official enrollment page: app.idx.us/account-creation/protect.
3. Enter your code and follow the registration steps.
4. Activate the credit monitoring part of the membership. The notice says it must be activated to work, and it needs an established credit file.
5. Save your enrollment confirmation.

Deadline: February 13, 2027. If your letter has no code or you have trouble enrolling, call 1-866-200-0940 (Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays).

IDX benefit	What it provides
Single-bureau credit monitoring	Alerts for qualifying changes on one bureau’s file
CyberScan	Monitoring for personal information in underground online sources
Identity-theft insurance	Up to $1,000,000 reimbursement, subject to policy terms
Managed identity recovery	Specialist help if identity theft occurs
Coverage period	24 months

The $1,000,000 is an insurance limit for covered identity-theft losses. It is not a payment to every customer. Also, credit monitoring does not watch your card transactions. A fraudulent card purchase usually will not show up on your credit report, so keep checking your card statements yourself.

How to Spot a Fake Fandango Breach Email

Scammers copy real breach notices. Someone who knows your email address could send a convincing message asking you to “confirm” your card.

• Use the official IDX address above, not a link from an unexpected message.
• Enrollment is free. Never pay to activate it.
• Never give your full card number, CVV or a one-time passcode to anyone who contacts you.
• If unsure, call the incident helpline listed in your letter.

Laws That Apply to the Fandango Data Breach

Which laws apply depends on where each affected customer lives and exactly what data was taken. Fandango has not disclosed the number of affected customers or their states, so this section covers the main frameworks.

California

• Cal. Civ. Code § 1798.82 (breach notification). Requires a business to notify California residents when covered personal information is acquired, or reasonably believed to be acquired, without authorization. It also requires a sample notice to the Attorney General when more than 500 residents are affected, which is the filing here. Notice generally must go out within 30 calendar days of discovery under the law as amended effective January 1, 2026, subject to exceptions. Covered information includes a card number combined with a required security code, but the statute’s definition is tied to a person’s name. Fandango says names were not involved, so whether California’s definition is met for any given customer is not settled by the public record.
• Cal. Civ. Code § 1798.81.5 (reasonable security). Requires businesses that own or license California residents’ personal information to use reasonable security.
• Cal. Civ. Code § 1798.150 (private right of action under the CCPA). Lets a consumer sue when certain personal information is stolen because a business failed to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, or actual damages if greater, after the inflation adjustment effective January 2025. Two limits matter: the information must fit the statute’s definition (which, like § 1798.82, is tied to a name), and a consumer generally must give 30 days’ written notice and a chance to cure before seeking statutory damages. This is not an automatic payment.

Other state laws

Every state has a breach notification law, and many define covered card data differently.

• New York, Gen. Bus. Law § 899-aa and § 899-bb (SHIELD Act). Covers account and card numbers combined with a security code, and requires reasonable safeguards.
• Minnesota Plastic Card Security Act, Minn. Stat. § 325E.64. Bars merchants from keeping card security code data after a transaction is authorized, and lets banks recover card reissuance costs after a breach.
• Nevada, NRS 603A.215, and Washington, RCW 19.255.020. Tie card-data security duties to PCI compliance and let issuers recover certain costs.

These laws mostly shift costs between businesses and card issuers. They do not on their own give an ordinary customer a payment.

Federal law

• Fair Credit Billing Act and Regulation Z. Credit card dispute and liability protections described above.
• Electronic Fund Transfer Act and Regulation E. Debit card protections described above.
• FTC Act § 5, 15 U.S.C. § 45. The FTC can act against unfair or deceptive data-security practices. A breach alone does not prove a violation, and the Act gives consumers no private right to sue.
• Fair Credit Reporting Act, 15 U.S.C. § 1681c-1. Gives you free security freezes and fraud alerts. A freeze limits new accounts, but it does not stop charges on an existing card.

PCI DSS

The Payment Card Industry Data Security Standard sets security rules for businesses that handle card data. It is an industry standard set by the card networks, not a federal law. Fandango’s incident details have not been disclosed enough to say whether any PCI requirement was violated.

Can Fandango Customers Sue Over the 2026 Data Breach?

Possibly, depending on state law and what the evidence shows. Claims could involve negligence, breach of contract, or state privacy and consumer-protection statutes. A suit would have to answer:

• Was card information actually acquired by the attacker?
• What security did Fandango maintain, and was there an actionable failure?
• Did the customer suffer a compensable harm?
• Do the statutory damages provisions apply to the data involved?

Two obstacles often decide card-breach cases. First, standing: in TransUnion LLC v. Ramirez (2021), the U.S. Supreme Court held that a federal-court plaintiff needs a concrete harm, and courts disagree on whether an exposed card with no fraud is enough. Many customers also get reimbursed by their bank, which can limit damages. Second, arbitration: online terms of use often include arbitration or class-waiver clauses, and whether Fandango’s terms do and whether they would apply here is a question for a court.

As of November 14, 2026, no putative class action over the October 8 to 11 checkout incident has been verified in the public materials reviewed, and there is no court-approved settlement, claims administrator or claim deadline.

For a separate, filed putative class action, see Citizens Bank Hit With New Data Breach Class Action Lawsuit After Second Security Incident in 2026, Social Security Numbers and Birth Dates Exposed. It involves a different company and gives Fandango customers no rights.

Is This Related to Fandango’s $9.4 Million Settlement?

No. The two matters are unrelated. Beer v. Fandango Media, LLC involved allegations over undisclosed ticket convenience fees and FanClub practices during earlier periods. The settlement administrator reports payments went out on October 21, 2026. That settlement does not cover the October 2026 card exposure, and customers should not use its website to report this breach.

Our earlier coverage is here: Fandango Media $9.4M Convenience Fee Class Action Settlement 2026 California Ticket Buyers and FanClub Members Can Claim Cash or a Voucher Before August 17.

What If Your Card Is Used After the Fandango Incident?

Keep your statements, bank alerts and all messages with your issuer. Report the charge, ask for a replacement card, and if you suspect broader identity theft, place a free credit freeze at Equifax, Experian and TransUnion and file a report at the FTC’s IdentityTheft.gov. IDX’s recovery team is also part of your free benefit. Save receipts for any out-of-pocket costs, since documented losses are what real settlements typically reimburse.

Fandango Data Breach 2026 FAQ

Was Fandango hacked in October 2026?

Fandango confirmed an incident on its online checkout in which an unauthorized party could access payment-card information tied to certain transactions from October 8 through 11, 2026.

Were Fandango credit card numbers stolen?

Fandango says card numbers, CVVs, expiration dates, billing ZIP codes and email addresses may have been compromised. It has not confirmed that any card was misused.

How do I know if my Fandango payment was affected?

Check whether you paid on Fandango’s online checkout between October 8 and 11, and whether you received a Fandango security notice. Call 1-866-200-0940 if you are unsure.

Does the Fandango breach affect tickets bought in September?

The identified window is October 8 to 11, 2026. The notice does not say September purchases were affected.

Do I have to replace my card?

Fandango’s notice does not require it, but calling your issuer to ask is a sensible precaution because the CVV may have been exposed with the card number.

Were Social Security numbers stolen in the Fandango breach?

No. Fandango says Social Security numbers and government IDs were not involved.

Were Fandango account passwords exposed?

The notice does not list passwords as exposed.

Has anyone reported fraud from the Fandango breach?

Fandango says it is not aware of fraudulent use. That does not rule out later misuse.

How many Fandango customers were affected?

The number has not been disclosed in the notice reviewed.

Is Fandango offering free credit monitoring?

Yes, 24 months through IDX, with enrollment required by February 13, 2027.

Can I get $799 from Fandango for the data breach?

No payment has been announced. California law allows statutory damages of $107 to $799 only in qualifying cases, and it is not clear the statute’s definition of covered information is met here because Fandango says names were not involved.

Is there a Fandango data breach class action settlement?

None has been verified for the October 2026 incident. The $9.4 million settlement concerns unrelated ticket-fee allegations.

Official Fandango Breach Contacts and Sources

Fandango incident helpline: 1-866-200-0940, Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays.

Free IDX enrollment: app.idx.us/account-creation/protect (deadline February 13, 2027)

• California Attorney General: Fandango Individual Notice (PDF)
• California Attorney General: Data Breach Database
• California Privacy Protection Agency: CCPA Monetary Thresholds
• CFPB: Unauthorized Credit Card Charges
• CFPB: How to Dispute a Credit Card Charge
• CFPB: Protections When Card Data Is Hacked
• FTC: IdentityTheft.gov

Bottom Line

Fandango’s October 2026 checkout incident may have exposed card numbers, CVVs, expiration dates, billing ZIP codes and emails for certain purchases made October 8 to 11. Fandango has found no fraud so far. If you bought tickets online in that window, check your statements, ask your card issuer about a new card, and enroll in the free IDX protection by February 13, 2027. No settlement or automatic payment has been announced. This article will be updated if an affected-customer count, a lawsuit or new technical findings are confirmed.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against Fandango’s individual notice filed with the California Attorney General, IDX’s enrollment page, and CFPB payment-dispute guidance, as of November 14, 2026. Last Updated: November 14, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.