Ransomware Attack Disrupts Ticket Sales at French Museums
A large-scale ransomware attack is targeting Vivaticket, an Italian ticketing platform used by numerous cultural institutions in France, causing online booking systems to fail. The cybercriminal group RansomHouse, reportedly based in Russia with ties to Iran, has claimed responsibility, encrypting servers and stealing personal data to extort payment. As of March 19, 2026, museums such as Musée Guimet, Musée Rodin, and the Bibliothèque nationale de France have reported service interruptions, advising visitors to purchase tickets on-site. The attack is ongoing, with some venues like the Centre des monuments nationaux experiencing partial recovery, while others remain affected.
Key facts
- A ransomware attack hit Vivaticket, an Italian ticketing provider for European cultural sites.
- The attack has disrupted online ticket sales for multiple French museums since March 19, 2026.
- RansomHouse, a cybercriminal group with Russian and Iranian links, is responsible for the attack.
- Personal data was stolen, and systems were encrypted, forcing on-site ticket purchases.
- Institutions like Musée Guimet and the Bibliothèque nationale de France are impacted, with some services partially restored.
Entities
Institutions
- Vivaticket
- Musée de la Chasse et de la Nature
- Musée Guimet
- Musée Rodin
- MEP
- Bibliothèque nationale de France
- Centre des monuments nationaux
- Arc de Triomphe
- Musée d'art contemporain de Lyon
- Louvre-Lens
Locations
- France
- Italy
- Russia
- Iran