Fandango data breach letter: card numbers and CVVs from its ticket checkout page, October 8 to 11, 2026

Date	Event
October 8 to 11, 2026	Window in which card data on the checkout page could be accessed
October 30, 2026	Fandango determines which customers may be affected
November 13, 2026	Notice posted in California; Vermont records 18 residents
February 13, 2027	Deadline to activate the IDX monitoring offer

What happened in the Fandango data breach?

Fandango says it became aware of an issue with its ticketing checkout page, investigated with outside cybersecurity specialists and resolved it. The letter does not say what the issue was, how it was found, or how many transactions went through the page in those four days. The payment card breach notices guide compares other retailers' checkout-page letters in the log.

Was my CVV stolen in the Fandango breach?

The letter lists the CVV among the data that may have been affected, alongside the card number, expiration date and billing ZIP code. The letter's own advice is to watch statements and report unauthorized transactions to the card issuer or bank. Fandango says it is not aware of any fraudulent use of the information.

What information was not involved?

The letter names what was not part of the incident: first and last names, any government-issued identification, Social Security numbers and other account information. Vermont's record matches the card data: financial account codes and credit and debit account information.

What is Fandango offering people who got the letter?

Two years of IDX identity protection at no charge: credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services. The offer must be activated by February 13, 2027. Enrollment is at app.idx.us or by phone. The call center is 1-866-200-0940, Monday through Friday, 6 a.m. to 6 p.m. Pacific. Credit monitoring offers in breach letters compares such offers.

Is the Fandango breach email real?

The copy Fandango filed in California is an email with the subject line "Fandango – Notice of Security Incident". Its enrollment link goes to app.idx.us/account-creation/protect, and the phone number it gives for enrollment is 1-866-200-0940. An email that matches the subject, the link and the number matches the filed copy. One that points to a different site or asks for your card details does not. The monitoring itself includes dark web scanning for traded personal data, including card numbers. The letter also adds contact details for attorneys general and consumer protection offices in several states, including the District of Columbia, Iowa, Maryland and New York.

How many people were affected by the Fandango breach?

Not known yet. Vermont's 18 residents is the only count on file as of November 14, 2026. The California posting gives no number. The guide to reading a California AG breach notice explains what the posting shows.