Pandemonium Rocks refund form exposed ticketholders' bank details

Pandemonium Rocks, an Australian touring rock festival staged in April 2024, exposed the personal and banking details of its own ticketholders through a refund form on its website. Seven of the 13 scheduled acts withdrew before the events, and organisers offered buyers a partial refund of $70 if they submitted their bank account information through the form.

On the evening of Friday, April 19, 2024, the administrator results tab on that form was left enabled. A festival spokesperson said this meant that anyone who specifically requested the results tab could see the entries already submitted. Pandemonium Rocks said in a statement on its Facebook page that the window ran from 5.47pm to 7.20pm, and CIM reported that the problem was spotted at 7.13pm and closed by 7.20pm.

More than 400 ticketholders had their names, bank account and BSB numbers, email addresses and phone numbers left visible. Organisers said they would contact everyone who had used the form during the window and advised those people to tell their banks to update their details.

The festival did not publish a fuller account of the incident or its scope. It followed weeks of complaints about the lineup changes and about the size of the refunds on offer.