Leak at Palais de la Porte Dorée

On 2 March 2026, the Palais de la Porte Dorée — a Paris museum and cultural institution housing the Musée national de l'histoire de l'immigration and a tropical aquarium — was caught up in a large-scale cyberattack that hit more than 40 French cultural venues at once, including the Louvre, the Musée d'Orsay, the Bibliothèque nationale de France and the Eiffel Tower.

The incident was not a direct breach of the museum. It stemmed from a ransomware attack on Vivaticket, the shared third-party online ticketing provider used across the French cultural sector. The compromise of that single supplier simultaneously disrupted ticketing and exposed customer data at every institution relying on it, making this a supply-chain incident.

According to statements from the affected institutions and the Centre des monuments nationaux, the data potentially exposed for ticket buyers included:

• Last name and first name
• Email address
• Postal address
• Phone number
• Date of birth
• Purchase history
• Encrypted (hashed) account password

Authorities stressed that banking and payment data were not affected. At the time of disclosure, no confirmed data exfiltration or fraudulent use had been established, though exposure could not be ruled out, and customers were urged to stay alert to phishing and fraud attempts. The Paris public prosecutor opened a criminal investigation, and online ticketing was suspended and gradually restored over the following weeks while venues directed visitors to on-site ticket counters.