topic Re: Potential Eventbrite Data Breach in APIs & Integrations

Potential Eventbrite Data Breach

SebDaniels — Mon, 23 Jan 2023 14:51:49 GMT

Hi all,

There is a potential data breach when using the Eventbrite integrated app from the HubSpot Market place.

I have one Eventbrite account - lets call it User#1.

We work for multiple clients that use Eventbrite - let's call them Organisation#1, Organisation#2 and Organisation#3.

Organisation#1, Organisation#2 and Organisation#3 all add my User#1 to their teams so that I can access all their accounts easily.

HOWEVER - this means that any Eventbrite-HubSpot integration that is connected via User#1's account, will show event data from Organisation#1, Organisation#2 and Organisation#3.

And if "Automatically sync new events" is ticked, all new events and contacts will be imported into Organisation#1, Organisation#2 and Organisation#3 HubSpot instances.

- - -

Hope that makes sense.

Please comment with any questions below.

Thanks,

Seb

Re: Potential Eventbrite Data Breach

Jnix284 — Mon, 23 Jan 2023 16:23:29 GMT

@SebDaniels looking at the getting started guide, it looks like you have to configure the integration in each portal, and clearly states how to handle multiple organizations:

If your Eventbrite account has access to multiple organizations, you can switch between them to view events created for a different organization. Click the dropdown menu under Choose an organization to see their events, then select a different organization.

Have you already done this and it is still not working properly?

Re: Potential Eventbrite Data Breach

SebDaniels — Mon, 23 Jan 2023 16:40:11 GMT

Hiya, I think you've missed the point of my post:

if you use the same login to connect Eventbrite to HubSpot for Organisation#1, Organisation#2, and Organisation#3 in each of their HubSpot instances, then ALL three will have access to all the organisations connected to the users account i.e. Organisation#3 will be able to see all of Organisation#1's events.

Re: Potential Eventbrite Data Breach

Jnix284 — Mon, 23 Jan 2023 16:46:07 GMT

Hi @SebDaniels ah, I see, it's the visibility that is having an impact, but as the "User#1" aren't you the only one who can see all of the events, or can other users in each account see and modify the integration settings?

If so, my question would be, is there another user that is also an admin on each individual Eventbrite account that could be used to connect the app integration, instead of yours that has access to all 3?

Re: Potential Eventbrite Data Breach

SebDaniels — Mon, 23 Jan 2023 16:58:12 GMT

@Jnix284 so in Eventbrite, yes I'm the only person that can see each different organisation's events.

But in HubSpot, under the "Choose an organization to see their events" drop down, all the organisations I'm connected too will show up. And if "Automatically sync new events" is ticked, new events from all organisations are added AND the contacts are automatically added to HB.

Re: Potential Eventbrite Data Breach

Jnix284 — Mon, 23 Jan 2023 17:02:17 GMT

@SebDaniels understood, it's unclear from the documentation what the expected behavior for the "Automatically sync new events" checkbox is - whether that means all organizations, or only the one you are viewing in the dropdown.

@Jaycee_Lewis any insight on how to submit a bug report for the Eventbrite app integration, it is one that is provided by HubSpot?

Re: Potential Eventbrite Data Breach

SebDaniels — Mon, 23 Jan 2023 17:04:42 GMT

And yeah, your solution is the correct solution - use different email addresses for each Eventbrite instance and then connect each one to each HubSpot instance.

However, doing this removes the nice Eventbrite one account to access multiple organisations' functionality and creates another potential data breach, as you need to know login details for lots of different accounts and they need to be shared with you.

Re: Potential Eventbrite Data Breach

Jnix284 — Mon, 23 Jan 2023 17:24:39 GMT

@SebDaniels agree that it is not ideal to have to create separate accounts for each organization - my suggestion wasn't for you to have multiple, but to have a second person at each organization.

For example:

USER#1 - Eventbrite Owner with access to org#1, org#2, org#3

USER#2 - added to eventbrite as an Admin, access to org#1 only

USER#3 - added to eventbrite as an Admin, access to org#2 only

USER#4 - added to eventbrite as an Admin, access to org#3 only

And then, in HubSpot, instead of having User#1 setup the app integration with Eventbrite, have User#2 set up for Org#1 so only Org#1 data pulls in, etc.

Re: Potential Eventbrite Data Breach

SebDaniels — Mon, 23 Jan 2023 17:33:01 GMT

Yeah that's a nice work around too.

As you've commented below, it would be good to flag it with Eventbrite.

In an ideal world, I think the best solution would be to have a HubSpot style gateway (like https://app.hubspot.com/myaccounts-beta). So when you connect to Eventbrite through the ingtergtaton, you have to choose which organisation you want to connect HB to.

Re: Potential Eventbrite Data Breach

Jnix284 — Mon, 23 Jan 2023 17:44:55 GMT

@SebDaniels I would definitely let them know about the issue, and your idea. The app marketplace has the support info if you want to try calling directly (the link just goes to the HubSpot website/support, which I imagine you could also use):