Stockholm open-air museum Skansen said its ticketing provider Visit suffered a data breach that also affected several of Visit's other customers, and it was informed on October 27, 2026 [1]. Possibly accessed data include names, phone numbers, emails and ticket purchase details of guests who booked between October 23 and 26, with no identity numbers or card details affected; Visit says the vulnerability is fixed [1]. Skansen advises never sharing payment card details, passwords or BankID credentials by email or text, and changing any disclosed passwords immediately [1].
LowMonitoringOfficially confirmed
Swedish ticketing provider Visit breached, exposing Skansen and other clients' guest data
1 min read
- Disclosed
- Oct 27, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Technology
- SaaS platform
- Attack vector
- Vulnerability exploitationThird-party compromise
- Impact
- Data exposure
- Data type
- Contact infoTransactions / orders
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
Timeline
- Skansen informed; guests contacted[1]
Technical details
Remediation
Vendor guidance
- 1Never share BankID or card details verify[1]
Never share card details, passwords or BankID by email or text.
References
Official / primary1
- [1]Skansen2026-10-27Accessed 2026-11-11Snapshot 2026-11-11 sha256 d0bdd5f906d6
“Skansen’s ticketing provider, Visit, has suffered a data breach. Skansen was informed of the incident on the afternoon of Tuesday 27 October 2026.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.