Leak at Musée des Arts et Métiers

On 18 March 2026, the Musée des Arts et Métiers — the Paris science and technology museum operated by the Conservatoire national des arts et métiers — was named among the cultural institutions whose customer data was exposed in the breach of ticketing provider Vivaticket.

The incident was not a direct attack on the museum. On 2 March 2026, Vivaticket — an Italian platform that powers online ticketing and shop services for roughly 3,500 museums, monuments and venues across Europe — was hit by a ransomware attack claimed by the RansomHouse group, reportedly through its French subsidiary. The attackers encrypted systems and exfiltrated personal data belonging to the customers of the affected venues, making this a supply-chain compromise rather than a flaw in the museum's own systems.

The data exposed for affected customers included:

• First and last name
• Email address
• User-account information (and, for the wider Vivaticket dataset, account identifiers and passwords)
• Order and ticketing history

Vivaticket stated there was no evidence that banking or payment-card data — handled by a separate provider — had been accessed. The breach affected an estimated several million records across all impacted venues; no museum-specific figure for the Musée des Arts et Métiers has been published. At disclosure, online ticketing remained disrupted across many of the affected sites and a Paris prosecutor's investigation was under way, leaving the incident ongoing.