Cyber Incident Victim: MC2
Date:
Jun 2024
Location:
France
Summary
A cyberattack on ticketing provider Sirius compromised access credentials to a production server, exposing personal data of customers at over 350 French venues including MC2. Stolen information included names, email addresses, phone numbers, and postal addresses, though financial details remained unaffected. The affected organization notified regulatory authorities, reset customer account passwords, and advised impacted individuals to change similar credentials on other platforms while monitoring for suspicious activity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 28, 2024, Sirius—a ticketing software provider servicing over 350 French entertainment venues, including Grenoble’s MC2—disclosed it had been targeted in a cyberattack. Attackers compromised production server credentials, resulting in unauthorized access to and exfiltration of confidential data stored on the affected server. The breach impacted MC2’s ticketing system, which relied on Sirius’s infrastructure. Personal data exposed included full names, email addresses, telephone numbers, and physical mailing addresses of customers. Financial information was not compromised, as confirmed by MC2 in a notification email to affected clients. The venue emphasized that payment details remained secure due to segregation from the breached server. MC2 proactively notified France’s data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), of the incident in compliance with regulatory obligations.
In response, MC2 immediately reset passwords for all customer accounts on its online ticketing platform to prevent further unauthorized access. The venue directed impacted users to change identical or similar passwords across other personal accounts—including social media and banking services—and to monitor those accounts for suspicious activity. MC2’s communications clarified the technical scope of the breach, confirming attackers exploited stolen credentials rather than deploying malware or ransomware. No operational disruptions to ticketing services or performances were reported. The venue established a dedicated email contact ([email protected]) for additional inquiries but did not disclose whether forensic investigations identified the attackers’ origins or motives. Impact assessments focused exclusively on data confidentiality loss, with no evidence of data alteration or destruction.