What Happened
In the irec.fr / Irec SAS data breach of February–March 2026, the ticketing company for amusement parks, concert venues, and sporting events in France was hit by the RansomHouse ransomware group, which exfiltrated customer and contact data before threatening public leaks. The attack is estimated to have occurred on 28 February 2026 and was publicly claimed by RansomHouse on 13 March 2026. Subsequent underground forum postings describe a database attributed to Irec SAS / Vivaticket containing about 148,240 contacts linked to a client, Semitour Périgord, with records spanning 24 October 2014 to 6 March 2025. The exposed data reportedly included names, email addresses (~148,000), phone numbers (~98,000), postal addresses (~98,000), associated organization, internal contact IDs, and record creation dates, along with city, postal code, and country details. The precise total number of affected records for the wider Irec/Vivaticket environment and leak size remains unknown, and neither Irec SAS, Vivaticket, nor Semitour Périgord has publicly confirmed the full scope of the compromise.