Your Tickets Were Stolen in a Hack. Your Arbitration Clause May Not Save You.

Imagine opening your team's app on game day and finding that your tickets are simply gone. A group of baseball fans say that is what happened to them during the 2025 season: someone broke into their MLB Ballpark app accounts, transferred their tickets out, and left them with an empty account and a ruined evening. The fans sued MLB Advanced Media, the company behind the app. The company responded the way most companies do, by pointing to the arbitration clause in its terms of use and asking the court to send the case to a private arbitrator. On September 30, a federal judge in New York refused, and the two reasons he gave say a lot about how much protection a company's fine print really provides after a cyber incident.

What the fans allege

The case is Lanham v. MLB Advanced Media, L.P., a proposed class action in federal court in Manhattan. The fans allege that the attackers took usernames and passwords stolen from other websites and tried them against Ballpark accounts, a technique that works because so many people reuse the same password everywhere. Once inside an account, the attackers transferred the tickets to themselves. The lead plaintiff says his tickets for a Chicago Cubs game disappeared on the day of the game itself. The fans claim the app's security made the intrusions too easy, pointing among other things to the absence of two factor authentication, and they brought claims that include negligence and breach of implied contract. These are allegations at this stage, not findings, and nothing has been proven against the company.

Problem one: did the fans ever agree to the terms?

To enforce an arbitration clause, a company first has to show that the user agreed to it. MLB Advanced Media pointed to emails and in-app pop-ups announcing its 2024 terms, along with terms linked on its sign-up and login screens during the 2025 season. The problem is timing. Most of the plaintiffs had opened their accounts years before those terms existed. The court held that the record did not establish whether, or when, those longtime users ever saw a screen that actually required them to accept the updated terms. Announcing that terms have changed is not the same thing as getting a user to agree to the change. On this record, the company could not prove the agreement it needed.

Problem two: the exception in its own terms

The second problem was one of the company's own drafting. Its terms carved out claims related to violations of users' privacy rights or interests and kept those claims out of the arbitration clause. The company argued that this case is about stolen tickets, not privacy. The court read the carveout more broadly: an intruder rummaging through your account implicates your privacy interest in that account and everything stored in it, even if the loss you care about is the tickets. Because the carveout reached any related claim and gave examples rather than limits, it covered most of what the fans alleged. The exception the company wrote for itself took the claims out of the arbitration clause it wanted to use.

Where the case stands

The same order trimmed the lawsuit in other respects. The negligence and breach of implied contract claims survived and will go forward in court. Claims under two New York consumer protection statutes were dismissed, an unjust enrichment claim the plaintiffs had already abandoned was dismissed with them, and one named plaintiff was dropped from the case for lack of standing. The net result is the one the company was trying to avoid: the core of the case stays in federal court, in public, and moves toward discovery on how the app's security actually worked.

The lessons, for businesses and for fans

For any business with an app, the first lesson is about records. This fight turned on proof: which version of the terms each user accepted, when they accepted it, and on what screen. Longtime customers are exactly where that proof tends to break down, because they signed up under older terms and older screens. The second lesson is about drafting. A privacy carveout written broadly and casually can quietly exempt the very dispute a company most wants to arbitrate. If cyber disputes are meant to be arbitrated, the exception has to be drawn narrowly and deliberately.

For fans and other users, the takeaway is simpler. If your account is taken over and something of value disappears, the first fight in the lawsuit is often about where the case will be heard at all. And as this case shows, the company's own terms, the ones nobody reads, may be what keeps you in court. Whether those terms hold up usually comes down to design and records, not to the fine print in the abstract.

Last week's post in this space looked at what companies put into their terms. This case is the sequel: what happens when a company reaches for its terms after something has gone wrong, and finds they do not reach as far as it thought.

Gabriel Vincent Tese is an attorney with Spector Gadon Rosen Vinci P.C. in Philadelphia focused on cyber litigation and technology law. He can be reached at gtese@sgrvlaw.com.

This post is general information, not legal advice. For advice about your specific situation, consult an attorney.