Two of Sweden's best-known visitor attractions have warned customers about a possible leak of booking information after a breach at their shared ticketing supplier. Stockholm open-air museum Skansen told Swedish newspaper Dagens Nyheter that unauthorised parties gained access to information about people who booked tickets between 23 and 26 October. The breach happened at Visit, the company that supplies the parks' ticketing systems, rather than at Skansen itself.

What was exposed, and what was not

At Skansen, the information reported as exposed included names, addresses, phone numbers, email addresses and details of ticket purchases. No payment or card details were reported as affected at either park. Gothenburg amusement park Liseberg, which also uses Visit, said it was working closely with the supplier, which had taken action. Its communications chief, Clara Rosendahl, told Göteborgs-Posten that the park was cooperating with the supplier. Liseberg urged customers to be extra careful with emails and text messages asking you to click on links, provide information or make a payment. Neither park has disclosed how many people were affected, and it is not yet clear whether the two incidents are connected.

Why a supplier breach still puts visitors at risk

The incident is a reminder that a booking made with a trusted attraction can pass through several other companies' systems, and a weakness in one link can expose customers of all of them. The immediate risk described by the parks is phishing: criminals may use real booking details to make fake messages look convincing. Anyone who booked in the affected window should treat unexpected messages asking for payment details or login credentials with suspicion and contact the park through its official channels instead.

Sources: Sweden Herald and Daily Northern.