NEW YORK – A federal judge has kept two core claims alive in a proposed class action accusing MLB Advanced Media of failing to adequately protect digital tickets in the MLB Ballpark app, a ruling that arrives while Yankees fans are relying on the platform during another October run.
U.S. District Judge Arun Subramanian on Sept. 30 denied MLB Advanced Media’s bid to force the case into arbitration and allowed negligence and breach-of-implied-contract claims to continue.
The decision was not a complete victory for the plaintiffs. Subramanian dismissed one named plaintiff for lack of standing, threw out claims under two New York consumer-protection statutes and dismissed an unjust-enrichment count that the plaintiffs had abandoned.
Still, the ruling means the central security allegations remain in federal court for now.
The case, Lanham v. MLB Advanced Media, L.P., stems from a 2025 cyberattack that plaintiffs say caused digital tickets to disappear from user accounts and potentially exposed personal information. The allegations have not been proven, and the judge’s ruling at this stage does not find MLB liable.
Fans say tickets vanished after accounts were accessed
Five ticket purchasers – James Lanham, Bradley Folkoff, Jake Harnish, Erin Oswald and Moira Logan – sued MLB Advanced Media, which operates the Ballpark app. The service functions as a digital wallet for baseball and some event tickets and also allows purchases and transfers.
According to the court’s summary of the amended complaint, the plaintiffs allege attackers used credentials leaked or stolen from other websites to gain access to Ballpark accounts, a technique commonly known as credential stuffing.
The plaintiffs contend that stronger protections, including two-factor authentication, could have prevented unauthorized access. MLB Advanced Media disputes liability and sought to dismiss the claims or move them out of court and into arbitration.
The court said the named plaintiffs described tickets disappearing from their accounts during the 2025 attack. One plaintiff recovered his ticket before the event began; others alleged they missed portions of events, bought replacement tickets, sought refunds or spent time dealing with the fallout.
The complaint also alleges that MLB Advanced Media collected information including names, addresses, birth dates, location information, usage data and device data through the app.
Judge rejects MLB’s broad arbitration push
MLB Advanced Media argued that its terms of use required the dispute to be resolved through individual arbitration. Subramanian rejected that argument for most of the remaining plaintiffs because the same terms contained a broad carveout for disputes related to privacy rights or interests.
The judge concluded that allegations involving unauthorized access to user accounts and stolen tickets fit within that privacy carveout, even though the plaintiffs also asserted non-privacy legal theories.
Logan’s situation remains different. Her tickets were held in a friend’s account, and the record does not yet establish whether she or someone acting on her behalf agreed to the arbitration terms. The judge said discovery is needed before MLB Advanced Media can renew that part of its arbitration argument.
Subramanian also ruled that Folkoff lacked standing because he recovered his ticket and alleged only lost time and speculative exposure of personal data. The court said those allegations did not establish a sufficiently concrete injury for him to remain in the case.
The New York General Business Law claims were dismissed because the complaint did not adequately allege that the relevant deceptive conduct occurred in New York. The negligence and implied-contract claims, however, were sufficiently pleaded to survive at this stage.
The judge also declined to strike the proposed class allegations for now, leaving MLB Advanced Media free to raise its class-waiver arguments later during class certification or summary judgment proceedings.
Why the ruling matters to Yankees ticket holders now
The case lands at a particularly visible moment for digital ticketing in New York. The Yankees swept the Red Sox in the Wild Card Series and are headed into the American League Division Series against the Rays, with Game 3 scheduled for Yankee Stadium on Oct. 7 and Game 4 there on Oct. 8 if necessary.
The Yankees’ current mobile-ticketing instructions direct fans to the MLB Ballpark app to access, manage and use tickets, including postseason tickets. The team’s official page says users may need to verify the email tied to their ticket account and log in to the associated Ticketmaster account to display the barcode.
The Yankees also tell fans that screenshots are not accepted for entry and recommend loading tickets before arriving at the stadium. That makes account access more than a convenience on game day; it can be the difference between reaching a seat on time and standing at a ticket-office window trying to resolve a problem.
The current lawsuit does not allege that Yankees postseason tickets in 2026 have been stolen, and the Sept. 30 order does not establish that the Ballpark app is presently insecure. The claims concern the 2025 attack and MLB Advanced Media’s alleged response to it.
But the ruling ensures that the company’s ticket-security practices will remain under legal scrutiny while MLB continues pushing fans toward digital-only access.
Case now moves toward discovery
The surviving plaintiffs still must prove their allegations. Discovery could test what security protections MLB Advanced Media had in place, what data or tickets were accessed, what users lost and whether any contractual promises were breached.
MLB Advanced Media can also continue challenging the case as it develops. The judge specifically left open future arguments over Logan’s arbitration status, the class-action waiver and whether the case can ultimately proceed on behalf of a broader class.
For now, however, MLB did not get the early exit it sought on the two central claims.
And with Yankees fans preparing to use the Ballpark app again for October baseball, a lawsuit born from allegedly vanishing digital tickets now has a longer runway in federal court.
What do you think? Leave your comment below.
