Veuve Clicquot: visitor data compromised after a cyberattack on the ticketing system

On 4 April 2026, Veuve Clicquot — the historic Reims champagne house — notified visitors that a cyberattack had compromised personal data held by the external provider running the online booking system for its cellar tours and Verzy estate visits. The intrusion, a ransomware attack on the third-party ticketing platform rather than on Veuve Clicquot's own infrastructure, is believed to date back to early March 2026, with the house emailing affected people on 3 April 2026.

The breach stemmed from the compromise of a shared booking vendor, making this a supply-chain incident. The same provider was also used by champagne group Vranken-Pommery, which separately confirmed that its own visitors' data had been exposed. Veuve Clicquot warned that the exposed information could be exploited for targeted phishing, fraudulent SMS and impersonation of its reservation service.

According to the notification, the data potentially accessible to malicious actors concerned anyone who had used the online reservation system going back at least to July 2024, and may include:

• Full names
• Dates of birth
• Phone numbers
• Email addresses
• Booking details (visit dates, reservation type and amounts)

Veuve Clicquot said it had contained the incident and was notifying impacted individuals by email, advising vigilance against suspicious messages purporting to come from the house. The total number of affected visitors was not disclosed.