Philadelphia Orchestra, Kimmel Center ticketing systems remain hampered after cyber attack

The ticketing systems of the Philadelphia Orchestra and Kimmel Center Inc. remained hobbled for a fifth day Monday following a cyber attack that struck last week. The arts group was able to set up a temporary website portal Feb. 12 with tickets available for some concerts, though functionality of the joint site was still severely curtailed.

The attack on POKC has drawn the attention of the FBI. The agency declined to say whether it was investigating the incident, citing a policy of not confirming or denying such involvement. But FBI Philadelphia spokesperson Carrie Adamowski said that it was “aware of the cyber incident affecting the Philadelphia Orchestra and Kimmel Center,” and when it learns about such incidents, “it’s customary that we offer our assistance.”

Arts center leaders continued to be tight-lipped about the exact nature of the attack, which hit sometime Thursday. The organization is working with cybersecurity experts, said POKC president and CEO Matías Tarnopolsky, and the consultants have assured POKC that no customer credit card information or data about the group’s donors had been compromised.

Tarnopolsky said he hopes the websites’ full functionality will be restored sometime in the next few days.

» READ MORE: Want to buy tickets to the Kimmel Center? Here's everything you need to know.

The assault on the ability to bring in ticket revenue is unprecedented in the arts center’s 21-year history. Cyber attacks on arts institutions have been relatively rare, though the Metropolitan Opera experienced a similar incident in December.

The sectors most frequently hit in 2021 were manufacturing, finance and insurance, professional and business services, energy, retail and wholesale, health care, transportation, government, education, and the media, according to an IBM report.

The FBI said it wasn’t aware of any trends targeting arts organizations.

“It’s more that, these days, cybercriminals are probing nonstop to find vulnerabilities in the networks of businesses of all types and sizes,” said the FBI’s Adamowski. “Basically, they’re looking for ways into any network that holds the personal or financial data of employees, customers, or both, that can be monetized or posted online.”

Cyber attacks globally were up 38% in 2022 over 2021, according to Check Point Research.

“It’s not a question of if. Now it’s a question of when,” says Drexel University’s Robert D’Ovidio, who directs Drexel’s research program in computer crime and digital forensics.

Kimmel-Orchestra officials have declined to specify what kind of cyber incident this was, but D’Ovidio says that considering the kind of attacks that are popular right now and the length of time the Kimmel and orchestra sites have been crippled, he “would not be surprised to learn it was some kind of ransomware attack. When we see this kind of outage, one of the things we can make an assumption about is that they are locked out of access. And as a rule they are either trying to reestablish that system, trying to get it back up, or possibly working with the people who launched the attack to get back access.”

When attacks do come with a ransom demand, insurance companies are increasingly choosing to pay them, D’Ovidio said. If this was a case of ransomware, “the loss in ticket sales could be audited, and based on the potential ransom, they would make a decision about whether this is a worthwhile payout or not.”

Tarnopolsky declined to say whether the attack involved ransom. “We’re simply not commenting on that.”

As for losses in ticket income, Tarnopolsky said it was too soon to tell.