Liseberg and Skansen Data Breach Traced to Ticket Supplier Visit

Executive Summary

The Liseberg and Skansen data breach stems from an intrusion at Visit, a ticketing and booking supplier. It became public on 27 October 2026. Skansen said unauthorised parties accessed details of visitors who booked tickets between 23 and 26 October including names, addresses, phone numbers, email addresses and purchase information. Liseberg warned of a possible leak of names, email addresses, phone numbers, addresses, company names and visit dates from its booking system. Neither park says payment or card data was affected and both have warned customers about phishing. How many people are affected and how the intruders got in have not been disclosed.

What the Visit Data Breach Exposed at Each Park

Liseberg learned of the intrusion shortly before 17:00 on 27 October, when the supplier of its booking system told the park it had been breached according to communications head Clara Rosendahl. The park contacted guests who might be affected that evening. Its fraud and security notice also reported a disruption to online booking and said there was no sign the information had been used for fraud.

Skansen, the open-air museum in Stockholm, placed the breach at Visit and limited the exposure to bookings made from 23 to 26 October. Liseberg’s own statements refer only to its system supplier. That it also uses Visit comes from published reports, not from the park.

The two data sets aren’t identical. Liseberg lists company names and visit dates, Skansen lists ticket purchase details.

Gaps in the Supplier’s Account

Liseberg said the supplier has taken measures. Neither park has described what failed at Visit, given a number of affected customers or said whether other Visit clients are exposed. The disclosures came six days after CERT-SE issued a flash alert on two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated code execution. No party has linked the Visit intrusion to those flaws. It is also unclear whether the two parks’ incidents are connected beyond the shared supplier.

Liseberg’s 2023 Plan to Check Its Suppliers

Liseberg is owned by the City of Gothenburg and files its data protection reports among the city’s company documents. Its data protection report for 2022 to 2023 set out an action plan for 2023 to 2024. Item 3 called for a routine of regular compliance checks on the processors Liseberg hires. These are suppliers that handle personal data on its behalf. The same item asked for a way to assess GDPR responsibilities whenever suppliers are engaged. The target was the second quarter of 2024. The plan noted that this depended on hiring someone to work solely on data protection.

The company’s 2025 report does not mention that item. It records two major personal data incidents at Liseberg in 2024, both reported to IMY (Integritetsskyddsmyndigheten, the Swedish data protection authority) and to the city’s CISO. It also says data protection work was partly held back after the fire at the Oceana construction site on 12 February 2024.

Both documents predate the Liseberg and Skansen data breach.

A 72-Hour Clock Running From 27 October

GDPR Article 33 gives a controller 72 hours from becoming aware of a personal data breach to notify IMY, unless the breach is unlikely to put people at risk. Counted from the time Liseberg gave, that window closes around 17:00 on 30 October 2026. This breach sits with a supplier, the exact relationship Liseberg’s own plan set out to check routinely from mid-2024. Liseberg has not said whether that routine was ever put in place.

References

1. Bedrägeri och säkerhet
2. Dataskyddsfrågor Liseberg år 2022-2023
3. Dataskyddsfrågor Liseberg år 2025
4. BM26-003 Kritiska sårbarheter i PHP

This post is also available in: