Online ticketing: why security is not optional

When you choose a ticketing or booking platform, you look first at the sales page, the per-transaction fees and how easy it is to learn. Security rarely tops the list. You assume it has been taken care of, much as you assume the building you walk into meets the building code.

Yet your ticketing system holds much of what your organization holds most valuable: the name, email, phone number and often the address of every one of your customers, plus the history of what they bought, when, and for whom. For an attacker, that is a very profitable target. And when it falls, the name your customers remember is yours, not your vendor's.

Two incidents that shook the industry

xPayrience (Quebec, 2026): 414,000 Quebecers exposed

On July 11, 2026, xPayrience, an Eastern Townships ticketing platform specializing in events and tourist activities, suffered a data breach. A file containing the information of 413,935 customers later surfaced on the dark web. It held names, emails, phone numbers and full mailing addresses, along with information tied to some 476,000 tickets and 402,000 accommodation bookings.

The organizations affected are household names here: Foresta Lumina at Parc de la Gorge de Coaticook, ComediHa!, QMJHL teams such as the Saguenéens de Chicoutimi and the Foreurs de Val-d'Or, the Grand Prix Ski-Doo de Valcourt, campgrounds and lodging sites.

One piece of good news: no credit card data was compromised, because payments went through a specialized processor (Stripe). That detail matters, and we come back to it below.

Ticketmaster (2024): the largest breach in ticketing history

In May 2024, the ShinyHunters group put the data of an alleged 560 million Ticketmaster customers up for sale (1.3 terabytes of information), for US$500,000. Live Nation, its parent company, confirmed the unauthorized access. The data included names, addresses, emails, phone numbers and partial credit card information.

The cause was nothing sophisticated. The attackers used stolen credentials to log into a database hosted with a third-party cloud provider (Snowflake), and that account was not protected by multi-factor authentication.

Ticketmaster sells tickets across Canada. Canadians ended up in those files without ever having chosen the platform: they had simply bought a ticket to a show.

What these incidents have in common

1. Size is no protection. A North American giant and a Quebec SME were hit two years apart. Attackers do not pick targets by reputation: they look for the ones that are easiest to reach and hold the most data.
2. One vendor breached means hundreds of organizations breached. When a ticketing platform falls, every organization using it falls with it. None of the Quebec festivals, campgrounds and tourist sites caught in the xPayrience breach had done anything wrong. They had simply entrusted their data to the wrong place at the wrong time.
3. The reputation at stake is yours. Your customers do not necessarily know which platform you use. The notification email, the phone questions and the hesitation at the next purchase are all yours to handle.
4. An attack does not only steal data: it can stop your sales. Ransomware that encrypts a vendor's servers takes its entire ticketing system offline. In the middle of your season, a few days without online sales means lost revenue, line-ups at the counter and an overwhelmed team.
5. So-called "non-sensitive" data has value. A name, an email, a phone number and an address, paired with a purchase history, are enough to build a very convincing phishing attempt. For example: "Hello Julie, your ticket for Foresta Lumina on August 14 requires payment verification…" That kind of fraudulent email is far more credible than generic spam.
6. Breaches usually come from the basics. Multi-factor authentication was missing, an access path went unmonitored, an intrusion sat unnoticed for weeks. Security is first and foremost a daily discipline.

Why constant monitoring matters

Now that artificial intelligence can write code in a matter of hours, the number of new players (and of in-house ticketing tools built from scratch) has grown sharply. That is good news for innovation. It is less good news for security: the more improvised platforms there are, the more data breaches there will be.

Building software is one thing. Monitoring it in real time is another. In Canada, even a name or an email address is personal information you are required to protect. If you are counting on saving money with a custom in-house solution, add the cost of that monitoring to your calculation: not an occasional check, but watching for intrusions every day of the year: including show nights and long weekends, which are precisely the moments attackers choose.

At PRÉSENCE, we have built that expertise. Intrusion attempts are monitored at all times, and we rely on the same detection and protection services used by large platforms such as Netflix and Amazon Prime Video. It is work your customers never see, and that is exactly the point.

In Quebec, Law 25 makes you responsible

Since Law 25 came fully into force, an organization that collects personal information is responsible for it, even when it entrusts the processing to a vendor. In the event of an incident presenting a risk of serious injury, you must in particular:

• notify the Commission d'accès à l'information;
• notify the individuals concerned;
• keep a register of incidents.

Administrative penalties can reach $10M or 2% of worldwide turnover, and penal fines $25M or 4%. Even short of that, handling an incident is expensive: staff time, communications, legal advice, lost customers.

Choosing a secure ticketing platform is therefore also a compliance question.

Eight questions to ask your ticketing vendor

1. Where is credit card data stored? The right answer is "nowhere on our side." Payments should go through a PCI DSS certified processor (Stripe, Moneris, Global Payments, and so on), and the platform should never keep card numbers. In the xPayrience case, that is exactly what averted the worst.
2. Is admin access protected by multi-factor authentication? The Ticketmaster breach could have been prevented by that single measure.
3. Where is the data hosted, and with whom? A large, recognized cloud provider offers a solid foundation, provided it is properly configured.
4. Who monitors the platform, and when? Ask how intrusion attempts are detected, who receives the alert, and how fast. This is the question that separates delivered software from a service that is actually operated.
5. Is the data backed up, how often, and can it be restored? This is your safety net against ransomware.
6. Is every communication encrypted (HTTPS)? This is the absolute minimum, on the public page as well as in the admin area.
7. What happens in the event of an incident? Is there a clear process to notify you quickly, so you can meet your own obligations under Law 25?
8. Can you retrieve your data, then have it deleted, if you leave the platform? Data sitting with a former vendor remains a risk.

A serious vendor will answer these questions directly. Hesitation is itself an answer.

And on your side?

The platform does not do everything. A few good habits sharply reduce the risk:

• Give every team member their own account: no shared password on a sticky note at the counter.
• Remove seasonal employees' access as soon as their contract ends.
• Turn on multi-factor authentication everywhere it is available.
• Avoid exporting your customer lists into files that linger on workstations or in inboxes.
• Collect only the information you genuinely need. Data you do not hold cannot leak.

Where PRÉSENCE stands

At PRÉSENCE, security is part of the core product, not a paid option:

• No card data stored with us. Payments are processed directly by certified processors such as Stripe, Moneris or Global Payments.
• Continuous intrusion monitoring, using the same detection services relied on by large global platforms.
• Hosting on Amazon Web Services, one of the most battle-tested cloud infrastructures in the world.
• Daily backups of all platform data.
• End-to-end HTTPS encryption, on your booking pages as well as in your admin area.
• Law 25 compliance tools, including managing your visitors' consent.

No platform can promise zero risk, and the ones that do should worry you. What we can promise is to take that risk seriously every single day: because your customers trust you, and you trust us.