Viva Ticket

Summary

Viva Ticket, a ticketing platform serving museums, theme parks and live events worldwide, experienced a ransomware attack that affected roughly 3,500 partner organizations including the Louvre. The incident potentially exposed customer identification and billing data but did not compromise bank details, and investigators have found no evidence of data theft or fraudulent use. In response, the company has taken steps to secure its systems and continues to provide ticketing services to venues such as Disney World, Ferrari World and major artist concerts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early March 2026, the ticketing platform Viva Ticket experienced a ransomware attack that disrupted its services. The attack was reported publicly on March 26, 2026, after the incident had already begun. Viva Ticket provides ticketing and event management services to museums, theme parks, and live events around the world. Approximately 3,500 partners using the platform were affected by the incident.

The ransomware operation potentially exposed customer identification and billing information stored in the system. According to the available information, bank details were not compromised in the attack. No evidence of data extraction or fraudulent use of the exposed information has been found to date. The impact extended to high‑profile venues such as the Louvre, as well as other clients including Disney World, Ferrari World, and various major concert promoters.

Following the detection of the ransomware, Viva Ticket took action to secure its systems. The platform continues to provide ticketing services to major museums, theme parks, and live events worldwide. No further details about the attacker, ransom demand, or restoration timeline have been disclosed in the source material.

Sources

Sources available to members: 1 source.