Auction House Shuts Down Website After Christie’s Data Breach

According to a letter sent to its clients by the London-based auction house Christie’s, a May 9 cyberattack on the company yielded customer identification data, but not financial or transaction data. The Christie’s data breach forced the auction house to shut down its website just days before its marquee sale in New York.

Neither the attack nor the lack of a traditional website made much of a dent in sales. Christie’s brought more than $527 million for the three-part auction.

Art News reports that the attack was initially characterized by Christie’s as a “technology security issue.” Then the RansomHub gang posted a message on the dark web saying they had hacked the company. They say they will auction off the stolen data, which they claim belongs to more than 500,000 clients.

According to Christie’s, the data is from an internal client verification system that houses information relating to client ID checks that it is required to retain for compliance reasons. It includes information from photographic identification documents such as passports and driver’s licenses.

Christie’s says it has yet to find evidence of data misuse related to the attack. It has informed authorities, and taken further steps to secure their systems. It is offering clients one year of free identity theft protection.

Its letter to clients recommends keeping an eye out for fraud, especially phishing, and monitoring accounts for unusual activity. “Use strong passwords, and be alert to fraud including emails asking you to enter login credentials, provide financial information, or give up any other personal data.”