Musée du Louvre, Eiffel Tower and Notre-Dame de Paris: Thousands of European tourist sites impacted by ticketing platform breach

Cyberattack Disrupts Online Reservations for Thousands of European Cultural Sites

In early March, a ransomware attack targeting Irec SAS, the French subsidiary of online ticketing platform Vivaticket, disrupted online reservations for nearly 3,500 museums, monuments, and cultural sites across Europe. The RansomHouse ransomware operation claimed responsibility, listing Irec on its leak site and asserting that stolen data included full names, purchase histories, reservation details, email addresses, login timestamps, account metadata, and countries of residence.

Among the affected sites were high-profile landmarks such as the Musée du Louvre, Musée d’Orsay, Arc de Triomphe, Eiffel Tower, and Notre-Dame de Paris. While Vivaticket confirmed no credit card or banking details were accessed, some ticketing services and organizational platforms remain unavailable. The French National Cyber Security Directorate (ANSSI) and law enforcement are investigating the breach alongside Vivaticket to assess its full scope.

The French Ministry of Culture stated that impacted institutions are still evaluating the financial and operational toll of the attack. Customers have been notified of the breach as authorities work to contain the fallout.

Source: https://www.scworld.com/brief/thousands-of-european-tourist-sites-impacted-by-ticketing-platform-breach

Notre-Dame de Paris cybersecurity rating report: https://www.rankiteo.com/company/notre-dame-de-paris

Musée du Louvre (Louvre Museum) cybersecurity rating report: https://www.rankiteo.com/company/etablissement-public-du-musee-du-louvre

SETE - Société d'Exploitation de la tour Eiffel cybersecurity rating report: https://www.rankiteo.com/company/soci-t-d-exploitation-de-la-tour-eiffel

"id": "NOTETASOC1775515562",
"linkid": "notre-dame-de-paris, etablissement-public-du-musee-du-louvre, soci-t-d-exploitation-de-la-tour-eiffel",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Nearly 3,500 museums, '
                                              'monuments, and cultural sites',
                        'industry': 'Ticketing and reservations',
                        'location': 'France',
                        'name': 'Irec SAS (Vivaticket)',
                        'type': 'Online ticketing platform'}],
 'customer_advisories': 'Customers notified of the breach',
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Full names, email '
                                                        'addresses, purchase '
                                                        'histories, '
                                                        'reservation details, '
                                                        'login timestamps, '
                                                        'account metadata, '
                                                        'countries of '
                                                        'residence',
                 'sensitivity_of_data': 'High (personally identifiable '
                                        'information)',
                 'type_of_data_compromised': 'Personal and reservation data'},
 'date_detected': '2024-03-01',
 'description': 'In early March, a ransomware attack targeting Irec SAS, the '
                'French subsidiary of online ticketing platform Vivaticket, '
                'disrupted online reservations for nearly 3,500 museums, '
                'monuments, and cultural sites across Europe. The RansomHouse '
                'ransomware operation claimed responsibility, listing Irec on '
                'its leak site and asserting that stolen data included full '
                'names, purchase histories, reservation details, email '
                'addresses, login timestamps, account metadata, and countries '
                'of residence.',
 'impact': {'data_compromised': 'Full names, purchase histories, reservation '
                                'details, email addresses, login timestamps, '
                                'account metadata, countries of residence',
            'identity_theft_risk': 'High',
            'operational_impact': 'Disrupted online reservations for nearly '
                                  '3,500 cultural sites',
            'payment_information_risk': 'None (confirmed no credit card or '
                                        'banking details accessed)',
            'systems_affected': 'Online ticketing services and organizational '
                                'platforms'},
 'investigation_status': 'Ongoing (ANSSI and law enforcement)',
 'motivation': 'Financial gain',
 'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'RansomHouse'},
 'references': [{'source': 'Cyber incident report'}],
 'response': {'communication_strategy': 'Customer notifications issued',
              'law_enforcement_notified': 'Yes (French National Cyber Security '
                                          'Directorate - ANSSI)'},
 'threat_actor': 'RansomHouse',
 'title': 'Ransomware Attack Disrupts Online Reservations for Thousands of '
          'European Cultural Sites',
 'type': 'Ransomware'}