Fandango is notifying customers that payment card numbers, CVV security codes, expiration dates, billing ZIP codes and email addresses entered at its online ticket checkout between October 8 and 11, 2026 may have been accessed by an unauthorized party. Fandango is offering 24 months of free IDX monitoring; no lawsuit over the breach had been identified as of November 15, 2026, and there is nothing to claim.
Breach Notice · No Lawsuit Confirmed · Nothing to Claim
This page reports a data breach notice. Fandango has not been found liable for anything, OCA has not identified a lawsuit over the breach, no class has been certified, and there is nothing to claim. This page is informational and is not legal advice.
What Is This About?
Fandango Media, LLC, the online movie ticketing company, is notifying customers that payment card details they entered on its ticketing checkout page may have been exposed. Fandango filed a sample of its notice with the California Attorney General on November 13, 2026.According to the notice, Fandango became aware of an issue involving its checkout page, investigated it with outside cybersecurity specialists and resolved it. The investigation found evidence that an unauthorized party could access payment card information associated with certain transactions on the checkout page from October 8 through October 11, 2026. Fandango says it determined on October 30, 2026 which customers’ information may have been affected. It has not said how many people that is, or how the checkout page was compromised.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Involved?
Fandango’s notice lists five pieces of information that may have been affected for each customer: the payment card number, the CVV security code, the expiration date, the billing ZIP code and the email address. That combination is what most online merchants ask for to approve a card-not-present purchase, which is why a checkout-page compromise is more serious for card fraud than a breach of stored account records.The notice says several categories were not involved: customers’ first and last names, government-issued identification, Social Security numbers and other account information. Fandango says it is not currently aware of any fraudulent use of the information.
What Fandango Is Offering
Fandango is offering 24 months of IDX services at no charge: credit monitoring and CyberScan dark-web monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery. Enrollment uses the code printed in the notice, and the deadline to activate is February 13, 2027. IDX notes that its credit monitoring requires established credit.The notice also asks customers to review credit reports and financial accounts and to report any unauthorized transactions to their card issuer or bank. Under federal law, cardholders’ liability for unauthorized credit card charges is capped at $50, and most issuers waive even that; debit card protections are weaker and depend on how quickly the cardholder reports the charge, a difference the Federal Trade Commission explains on its website.
Has a Lawsuit Been Filed?
As of November 15, 2026, OCA had not identified a class action over the checkout breach, though at least one law firm has announced it is looking into the incident. Payment-card breaches at online checkout pages have led to class actions against other retailers, typically alleging that a company failed to secure the page and seeking the cost of replacing cards and dealing with fraud. Any such claims would be allegations.This breach is unrelated to the earlier Fandango convenience fee and FanClub settlement, which paid class members in October 2026. OCA will update this page if a complaint is filed or Fandango reports how many customers were affected.
Questions
What information was exposed in the Fandango data breach?
According to Fandango’s notice, the information that may have been affected was the payment card number, CVV security code, expiration date, billing ZIP code and email address. The notice says customers’ first and last names, government-issued identification, Social Security numbers and other account information were not involved.
Which Fandango purchases were affected?
The notice says an unauthorized party could access payment card information tied to certain transactions on Fandango’s ticketing checkout page from October 8 through October 11, 2026. Fandango determined on October 30, 2026 which customers’ information may have been affected and is notifying those people directly. It has not said how many customers were notified.
What does Fandango’s notice tell customers to do about their cards?
The notice asks customers to review credit reports and financial accounts for suspicious activity and to report any unauthorized transactions to their card issuer or bank. Fandango says it is not currently aware of any fraudulent use of the information. Under federal law, a cardholder’s liability for unauthorized credit card charges is capped at $50.
How do I enroll in Fandango’s free credit monitoring?
Fandango is offering 24 months of IDX services, including credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and identity theft recovery services. Enrollment uses the code in the notice through IDX’s account-creation website, and the deadline to activate is February 13, 2027.
Is there a Fandango data breach class action?
OCA had not identified a filed class action over the October 2026 checkout breach as of November 15, 2026. A separate Fandango settlement over ticket convenience fees and FanClub practices paid class members in October 2026 and has nothing to do with this breach. There is no settlement, fund or claim form for the breach.
Sources
• California Attorney General — Fandango Media, LLC breach report and sample notice• IDX — identity protection enrollment
• Federal Trade Commission — Lost or Stolen Credit, Debit, ATM, and Prepaid Cards
