Informa Canada Inc dba Shop FAN EXPO Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Informa Canada Inc, doing business as Shop FAN EXPO, notified Indiana residents of a data breach in a filing reported to the Indiana Attorney General on June 05, 2026. The filing places the underlying incident on June 19, 2025, and states that 34 people were affected. The notice describes the exposed material as personal information.

Public detail remains limited to that filing. No further breakdown of the incident method, full scope beyond the stated number of people, or additional data categories has been released in the available record. For those whose information may have been involved, the practical question is what steps follow from a confirmed notice of this kind.

What happened

According to the breach notice filed with the Indiana Attorney General, Informa Canada Inc dba Shop FAN EXPO experienced a data incident dated June 19, 2025. The organization later reported the matter on June 05, 2026, identifying 34 affected individuals and characterizing the exposed data as personal information.

The filing does not describe how the incident occurred, whether systems were accessed remotely, how long any unauthorized access lasted, or what specific records were involved beyond the general category of personal information. Scale outside the stated figure of 34 people, any financial impact, and technical indicators are undisclosed in the public notice summarized here.

How a breach like this happens

Incidents that lead to notifications of this type commonly begin with unauthorized access to systems that store customer, registrant, or transaction records. Typical pathways include compromised credentials, phishing that yields account access, exploitation of unpatched software, or misconfigured storage that becomes reachable from outside the organization. Once inside, an attacker or automated process may copy files containing names, contact details, and related identifiers.

Organizations that run ticketed events, merchandise shops, or fan conventions often maintain databases of purchasers, attendees, and account holders. Those databases are attractive targets because they concentrate contact and identity-related fields in one place. After discovery, companies are generally required under state laws to notify residents whose information may have been involved and to file with attorneys general when thresholds are met. The precise sequence in any single case—including this one—remains a matter of the organization’s internal investigation and is not always published in full.

No threat group has been attributed in the available facts for this incident, and none should be assumed.

About Informa Canada Inc dba Shop FAN EXPO

Informa Canada Inc operates Shop FAN EXPO, a retail and event-related presence connected to fan conventions and related merchandise or ticketing activity. Businesses in this sector typically collect and retain information needed to process orders, manage accounts, communicate with customers, and fulfill event or product purchases. That can include names, email addresses, shipping details, and other personal data required for commerce and customer service.

A breach affecting even a modest number of people matters because the same categories of information used for legitimate transactions can be reused for fraud, account takeover attempts, or targeted phishing. Event and merchandise operators sit at the intersection of entertainment fandom and ordinary e-commerce, so the data they hold is both commercially useful and personally sensitive to the individuals involved.

The information in question

The breach notification names the exposed material as personal information. It does not list further specific fields such as Social Security numbers, payment card data, dates of birth, or government identifiers. Public detail on exact contents is therefore limited to that general description.

Organizations of this kind commonly hold account and order-related personal data. Whether any of those more detailed elements were present in the affected systems in this case is unconfirmed in the filing as summarized. Readers should treat only the stated category—“personal information”—as established by the notice and avoid assuming additional types without further official disclosure.

Why it matters

For the 34 people identified in the notice, the primary risks are misuse of whatever personal details were involved. That can include unwanted contact, attempts to reset accounts elsewhere using known email addresses or names, or social-engineering messages that reference a real past purchase or event interest. Even limited personal information can make phishing more convincing.

For the organization, a reported incident triggers notification duties, potential regulatory follow-up, and the need to support affected individuals. Reputational and operational costs can follow regardless of the absolute number of people involved. Because the filing is public through the Indiana Attorney General’s reporting channel, the fact of the breach is a matter of record even while many technical particulars remain undisclosed.

Were you affected?

If you have done business with Shop FAN EXPO or related Informa Canada channels and received a direct notice, treat that notice as the authoritative source for your situation. Practical first steps include:

• Read any official letter or email carefully for the exact data categories mentioned and any offered support (credit monitoring, call centers, or reference numbers).
• Change passwords on accounts that used the same email or credentials associated with the shop or event, and enable multi-factor authentication where available.
• Watch for unexpected messages that reference FAN EXPO, orders, or refunds; verify through official channels rather than links in unsolicited mail.
• Review financial and account statements for unfamiliar activity and consider a fraud alert with major credit bureaus if the notice suggests broader identity data may have been involved.
• Keep the notice and any case or reference number for your records.

You can also run a free exposure scan of your email address to check whether that address has appeared in known breach datasets. Such scans do not replace the organization’s own notification, but they can help you see whether the same address has surfaced elsewhere. Remain cautious with any service that asks for unnecessary personal data in return for a check. Further detail beyond the Indiana filing summarized here has not been provided in the available record; monitor official updates from the organization if you believe you may be among those affected.

AICompiled with AI assistance from public sources and published under our editorial standards.