What happened
On 29–30 May 2026 there was unauthorised access to Ferve, the third-party ticketing system used by the Melbourne International Film Festival; Ferve said only one client system was affected [miff-ia-ferve]. MIFF initially said 26,782 customers were affected, with names, email addresses, phone numbers and residential addresses exposed; it said no credit-card information or account passwords were accessed, and that the dataset does not include purchase history, booking totals or membership details [miff-co-jun], [miff-cd]. The party responsible later published customer data online [miff-ia-ferve].
Timeline
- 2026-05 — Unauthorised access to the Ferve ticketing system (29–30 May) [miff-ia-ferve].
- 2026-06 — MIFF statement: 26,782 customers affected (initial figure) [miff-co-jun].
- 2026-07 — MIFF notified additional affected customers without giving a new total, and said it had notified the OAIC, the ACSC and Victoria Police [miff-co-jul], [miff-ia].
Current status
Disclosed. A hacker claimed 340,000 records, which MIFF disputes as larger than its database [miff-cd]. The 26,782 figure is MIFF’s initial count and is a minimum, since MIFF later notified additional customers [miff-co-jun], [miff-ia].
Why it matters
Even a contact-details breach at a well-known cultural event feeds targeted phishing; this record keeps MIFF’s stated figure separate from the attacker’s disputed claim.