Foule devant une scène de spectacle éclairée, illustrant le piratage de la billetterie Le point de vente

Le point de vente breach: what we know about the Quebec ticketing hack and what to do

Ian-Rémi Lafleur
October 27, 2026
7 min read
0 comments

Since Friday, October 23, 2026, nobody has been able to buy tickets on Lepointdevente.com, Quebec’s main independent ticketing platform according to Le Devoir. The company confirmed a cybersecurity incident, and its investigation indicates that some buyer information may have been accessed in this Le point de vente breach.

If you’ve bought a show ticket in Quebec in recent years, you may be affected. And if your business entrusts customer data to an online platform, this incident concerns you too.

Le point de vente breach: what we know, day by day

Wednesday

Oct. 21

PHP releases fixes for two critical flaws nicknamed “php2shell.” The Canadian Centre for Cyber Security issues an alert the same day.

Friday

Oct. 23

Le point de vente detects “unauthorized activity in part of its technology environment” and takes its platform offline as a precaution. Tickets already issued remain valid.

Monday

Oct. 26

The ticketing company says some buyer information “may have been accessed.” The same day, the U.S. CISA confirms the php2shell flaws are being actively exploited.

Tuesday

Oct. 27

The company’s target date to come back online. This morning, the lepointdevente.com home page was responding again.

General manager Yannick Cimon-Mattar confirmed to Le Soleil that the platform was taken offline “as a precaution” after unauthorized activity was detected. “At this stage, the investigation indicates that some information relating to buyers may have been accessed. Anyone affected will be notified directly and will receive information about appropriate protective measures,” he said (our translation).

Venues were hit too. According to Radio-Canada, the system used to validate tickets at the door was also down. Le Devoir reports that the ticketing company sent venues a list of buyers’ contact details so they could admit the public, and that some fear they lost sales over the weekend.

Confirmed, or not yet

✔️ What is confirmed

The platform was taken offline on Friday, October 23, after unauthorized activity was detected.
According to the ongoing investigation, some buyer information may have been accessed.
Affected people will be notified directly, with information on protective measures.
The company is working with outside cybersecurity experts.
It widened its review to components affected by the critical PHP and Node.js flaws published last week.
Tickets already purchased remain valid.

❓ What isn’t

Exactly which information: the company hasn’t said, including whether payment data is involved.
How many people: no official number. Le Soleil writes that data on “millions of users” may be affected, without a sourced figure.
The cause: an outside source quoted by Le Soleil points to php2shell, but the company hasn’t confirmed it.
No hacker group has been reported claiming the attack.

So the facts are still thin. We’re sticking to what the company and the media have reported, and we’ll update this article if the notice to affected people adds details.

The php2shell lead: a flaw that affects your site too

On October 21, PHP fixed two critical flaws (CVE-2026-109618 and CVE-2026-109619) discovered by Wiz Research. Nicknamed “php2shell,” they let an attacker run code on a server remotely, without a password. PHP powers WordPress, Drupal, Joomla and a large share of websites. On October 26, the U.S. CISA added them to its catalog of actively exploited vulnerabilities.

Le point de vente hasn’t confirmed that php2shell is the cause. It did tell Le Devoir that it widened its review to components affected by the critical PHP and Node.js flaws published last week, and that this explained how long the maintenance took. Whatever the exact cause here, the lesson for a small business is the same: if your site runs on PHP and hasn’t been updated since October 21, it’s exposed.

Scams to watch for after an incident like this

The company is asking buyers, organizers and partners to stay alert to “any unusual message about tickets, refunds or payments.” Here’s what that can look like:

🎟️

Fake refund

An email saying “your show is cancelled, click to get refunded” that asks for your card number.

💳

Fake payment retry

“Your transaction failed during the outage, please confirm your payment details.”

📱

Text or call

A message that uses the real show and date you bought, to look believable.

🏢

Fake vendor

For venues and organizers: a fake invoice or a change of banking details “following the incident.”

For a real-world example of a fake message, see our article on the fake toll fine text scam.

You bought tickets on Le point de vente: what to do

☐ Watch your inbox: the company says it will notify affected people directly.
☐ Don’t click any refund or payment link received by email or text. Go to the site by typing the address yourself.
☐ Check your credit card statements for the past few weeks and report any unknown transaction to your bank.
☐ If you used the same password elsewhere, change it everywhere, and turn on multi-factor authentication on your email.
☐ No legitimate company will ask for your password or full card number by email.

Your business also trusts a platform with customer data

A concert venue doesn’t run its own ticketing: it hands it to a vendor. Your business does the same with online booking, its web store, its newsletter or its payment software. The day that vendor is hacked, it’s your customers who get the fake emails, and it’s you they call.

⚖️ In Quebec: when it’s your vendor that gets hacked

Your customers are still your customers. Under section 18.3, you may give personal information to a vendor to carry out a mandate, but through a written contract that sets out protective measures and requires the vendor to notify you of any breach.
Reasonable measures. Section 10 requires security measures suited to the sensitivity, quantity and medium of the information, including with the parties you entrust it to.
If there is an incident, sections 3.5 to 3.8 call for steps to reduce the risk, notice to the Commission d’accès à l’information and the people concerned if there is a risk of serious injury, and an entry in the incident register.

For information only, not legal advice. We don’t know the contracts between Le point de vente and its venues.

For your business: 6 checks this week

☐ List your PHP sites and apps: WordPress site, online store, customer portal, extranet, intranet.
☐ Ask your web host or agency in writing whether PHP was updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or has an equivalent fix.
☐ If a system runs PHP 8.1 or older without a fix, take it off the internet in the meantime, as CISA and the Canadian Centre for Cyber Security recommend.
☐ Ask the vendors who handle your customers’ data (ticketing, booking, payments, newsletter) what they have done.
☐ Prepare your customer message in advance in case a vendor is hit: what to watch for and which channel you’ll use to reach them.
☐ Make sure you keep a register of confidentiality incidents, as Law 25 requires.

A flaw like php2shell gets fixed in hours when someone is watching your servers. Our [REDACTED]d 24/7 monitoring with on-call technician intervention covers the servers and sites you entrust to us, and our cybersecurity services start with an inventory of what you actually expose. If your site is with a web host, also ask them the right security questions.

Book your free cyber check

Not sure whether your site runs a vulnerable PHP version, or what your vendors do with your customers’ data? The free cyber check reviews your sites, servers and vendors, and gives you a clear list of priorities.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Photo: Caleb Oquendo, Pexels (Pexels licence).