Data leak at Centre des Monuments Nationaux

On 6 March 2026, the Centre des Monuments Nationaux (CMN) — the French public body that manages and operates ticketing for more than 100 national monuments, including Mont-Saint-Michel Abbey, the Arc de Triomphe and the towers of Notre-Dame de Paris — disclosed a data leak affecting visitors who had booked tickets online.

The incident was a supply-chain compromise: the breach did not originate at the CMN itself but at its online ticketing provider, which was hit by a ransomware attack detected on 2 March 2026. Because the provider handles ticket sales for many French cultural sites, the exposure potentially reached a large, international pool of visitors numbering in the millions per year.

Data potentially exposed includes:

• Email addresses
• Names and surnames
• Country and postal code
• Ticket purchase history
• Hashed (encrypted) account passwords

Banking and payment-card data were not affected, as those are processed by a separate payment provider. In a notice sent to customers on 7 March, the CMN stated that no exfiltration or fraudulent use of the data had been established at that stage. The incident was reported to France's data-protection authority (CNIL) and is being monitored by the national cybersecurity agency (ANSSI) and specialist teams at the Ministry of Culture, with the investigation ongoing.