Philadelphia Orchestra, Kimmel Center websites down after cyberattack cripples ticket sales

The websites for the Philadelphia Orchestra and its home venue are still down days after they posted a notice saying they were dealing with a cyberattack. 

On Friday, the orchestra and the Kimmel Center said ticket sales were affected by a cyberattack, without providing further details. A spokesperson for the Philadelphia Orchestra did not respond to request for comment. 

“As we work to resolve this issue, we assure patrons that all performances on Campus [at the Kimmel Center] will proceed as planned and our security protocols are working as intended to protect sensitive data," the organizations wrote.

A temporary portal was created to facilitate ticket sales and the organizations confirmed that tickets are available in person.

Arts venues like the Kimmel Center – which also holds Broadway shows and the Philadelphia Ballet – are ripe targets for ransomware gangs eager to hold hostage critical systems like ticketing. 

The Metropolitan Opera in New York faced a similar situation in December, when a cyberattack shut down its website and box office.

The attack came at a particularly inopportune time, costing the popular opera house about $200,000 in sales each day during the busy holiday season.

While all performances continued as scheduled, the organization was unable to process new ticket orders or provide exchanges and refunds, eventually forcing them to contact the FBI about the incident. 

That incident followed a wide-ranging July ransomware attack on WordFly, a tech company providing digital marketing for dozens of popular cultural organizations in several countries.

The ransomware attack damaged email and text message marketing services for organizations like the Smithsonian, the Toronto Symphony Orchestra, Canada Stage, the Sydney Dance Company in Australia, the Royal Shakespeare Company, the U.K.’s Old Vic Theatre and several other major organizations.

The Smithsonian later said WordFly had told them it “worked with the attackers” and confirmed that the stolen data had been deleted.