Loading story…
A cyberattack on Irec SAS, the French subsidiary of online ticketing provider Vivaticket, disrupted online reservations for nearly 3,500 museums, monuments, and cultural sites across Europe. Major attractions affected included the Louvre, Musée d'Orsay, Musée du Quai Branly, the Arc de Triomphe, the Eiffel Tower, and Notre-Dame de Paris, with some booking services remaining unavailable after the intrusion. French authorities, including the national cybersecurity agency and law enforcement, were engaged to determine the scope of the incident, while impacted institutions began notifying customers and assessing operational and financial fallout.
The RansomHouse ransomware operation claimed responsibility and said it exfiltrated personal and reservation-related data from Irec systems, including names, email addresses, purchase history, reservation details, login timestamps, account metadata, and country of residence. Vivaticket said its investigation had found no evidence that credit card or banking data was accessed, but the breach raised concerns over exposure of customer information tied to travel and cultural visits across France and other European destinations.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Some affected organizations and ticketing services remained unavailable after the breach, and France's Ministry of Culture said each impacted institution was still evaluating the financial consequences. The disruption highlighted ongoing operational fallout across the cultural sector.
Impacted organizations began notifying customers of the breach while Vivaticket worked with the French National Cyber Security Directorate and law enforcement to determine the scope of the incident. Vivaticket said it found no evidence that credit card or banking information had been accessed.
The RansomHouse ransomware operation listed Irec on its leak site and claimed it stole personal and reservation-related data, including names, purchase history, reservation details, email addresses, login timestamps, account metadata, and country of residence. This public claim marked the incident as both disruptive and potentially data-compromising.
In early March, a cyberattack against Irec SAS, the French subsidiary of ticketing platform Vivaticket, disrupted online reservations for nearly 3,500 museums, monuments, and cultural sites across Europe. Major affected sites included the Louvre, Musee d'Orsay, Arc de Triomphe, Eiffel Tower, and Notre-Dame de Paris.
A cyberattack on a software vendor used by France's health ministry led to the theft of medical details affecting about 15.8 million people in France. Reporting indicates private health information was included in the compromised data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybernews.com
Open sourcethe420.in
Open sourcetechradar.com
Open sourcefrance24.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Travelex was hit by **Sodinokibi/REvil** ransomware in a New Year’s Eve attack that disrupted its website, mobile app, and card-payment systems across more than 1,500 stores worldwide. The attackers said they had encrypted the company’s network, stolen more than **5GB** of files, deleted backups, and demanded **$3 million**, later escalating pressure by threatening to publish or sell allegedly stolen customer data that they claimed included dates of birth, Social Security numbers, and payment-card information. Travelex acknowledged that some data had been encrypted but said it had no evidence that customer data had been exfiltrated, creating a direct dispute with the gang’s public claims. Reporting later indicated Travelex likely paid **285 bitcoin**—about **$2.3 million** at the time—to the REvil operators as recovery efforts dragged on for weeks. The incident drew added scrutiny because researchers had previously flagged Travelex’s exposure to insecure internet-facing services, including a potentially unpatched **Pulse Secure VPN** vulnerable to `CVE-2019-11510` and Windows servers exposed without Network Level Authentication, though the exact intrusion path was not confirmed. Travelex did not directly confirm the payment, saying it had worked with external experts while keeping regulators, partners, and U.K. law enforcement informed as services were gradually restored.
Aug 15, 2026
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026
**Washington Hotel (WHG Hotels/Fujita Kanko Inc.) in Japan** disclosed a **ransomware infection** after attackers gained **unauthorized access to multiple servers**, impacting parts of its internal network. The intrusion was detected on **February 13, 2026, around 22:00 local time**, prompting IT staff to **disconnect external/internet access** to contain spread; the company also notified **law enforcement**, formed an internal **task force**, and brought in **external cybersecurity experts** to investigate root cause, scope, and recovery. Initial findings indicate the attacker accessed **various business-related data** on affected servers, while the company said **customer membership/loyalty data** (including the “Washington Net” program) is likely unaffected because it is hosted/managed on **separate third-party systems** with no confirmed unauthorized access. Operational impact was described as limited, though some properties experienced **temporary credit card terminal outages**; broader guest services reportedly remained functional, and restoration is underway while the company evaluates potential **business/financial impact**. As of reporting, **no ransomware group had publicly claimed** the incident on monitored extortion sites.
Jun 29, 2026