Pierluigi Paganini
June 10, 2024
At the end of May, the auction house Christie’s disclosed a data breach after the ransomware group RansomHub threatened to leak stolen data. The security breach occurred in early May and the website of the auction house was unreachable after the attack.
According to BBC, Christie had problems in selling art and other high-value items worth an estimated $840 million due to a cyberattack. The spring auctions include a Vincent van Gogh painting valued at $35 million and rare wine, among other lots. Some sales have been delayed due to the cyber attack.
RansomHub claimed responsibility for the attack and added the company to its Tor leak site. The extortion group said they had stolen 2GB of sensitive information, including personal information belonging to at least 500,000 Christie’s clients.
“While utilizing access to Christies network we were able to gain access to their customers sensitive personal information including [BirthPlace MRZFull DocumentNumber BirthDate ExpiryDate FirstName LastName IssueDate IssuingAuthority Sex DocumentCategory DocumentType NationalityName] as well as address, hieght, race and much more sensitive information for at least 500,000 of their private clients from all over the world.” states the group.
The group threatened to leak the stolen data if the victim did not pay the ransom by Sunday, June 2,024.
The gang said it has attempted to negotiate the payment with the auction house without success. The gang added that after they will post stolen data, Christie will incur heavy fines from GDPR.
The auction house notified privacy regulators and law enforcement.
According to Christie’s Individual Notification Letter shared with the Maine Attorney General, the threat actors stole some files containing personal information, including names, driver’s license numbers, and non-driver identification card numbers. The incident impacted 45,798 individuals.
“On May 9, 2024, we discovered that we were the victim of a cybersecurity incident that impacted some of our systems. As soon as we became aware of this event, we promptly took steps to secure our environment, launched an investigation, and engaged external cybersecurity experts to assist. We also notified law enforcement and continue supporting their investigation. The investigation revealed an unauthorized actor accessed some of our systems and certain files stored therein between May 8, 2024, and May 9, 2024, and some files were copied from those systems on May 9, 2024.” reads the letter. “We conducted a robust review of the files to identify individuals whose information may have been impacted and worked to obtain addresses and notify them as quickly as possible after completing the review on May 30, 2024.”
The company is offering identity theft and fraud monitoring services for one year.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)
