Why am I being prompted to change my password?

Security solution providers collect compromised credentials on some websites/mobile apps so businesses can see whether their customers’ emails and passwords were stolen. If you were prompted to change your password, your credentials matched the lists from the solution provider. This does not mean your StubHub account was breached or hacked.

How does StubHub have access to my ID and password from other websites?

StubHub doesn’t have access to the customer ID and password, nor the compromised credentials on the list. The matching is all encrypted. 

Where was my ID and password compromised?

StubHub doesn’t know which websites/apps were breached. If you were prompted to change your password, you should change your passwords on all websites/apps using this email and password combination.

Were my ID and password compromised on StubHub?

The compromised credentials are from other websites. If StubHub experiences a data breach, we will communicate directly to customers with impacted accounts immediately. To date, StubHub hasn’t had attacks resulting in stolen passwords.    

What if I don’t change my password?

If you don’t change the password, fraudsters may try to log into websites/ apps using the compromised credentials. You’ll also see a two-factor (2FA) authentication challenge to verify your identity each time you sign in with the compromised credentials.

What are some best practices to manage and protect my password?

Review this University of California, Santa Barbara article for password best practices.