Christie’s $578M art auctions halted by cyber attack, moved offline

TLDR:

• Christie’s website was taken offline due to a cyber attack, but auctions proceeded offline
• Security concerns arose about financial data of art collectors being compromised

One of the world’s leading art auctions, Christie’s, faced a cyber attack that took its website offline, leading to concerns about the security of financial data of art collectors. The incident occurred during a busy week of high-profile art auctions, but auctions continued offline through in-person and phone bidding. With an estimated $578 million in art up for bid, and with some pieces valued as high as $20 million, the security breach raised significant alarm. While the attack did not halt scheduled auctions, the extended website downtime hinted towards possible ransomware, increasing the risk of data extortion.

Christie’s response to the cyber attack has drawn criticism, as the lack of transparency about the incident and potential data exposure has damaged their reputation for security. This incident underscores the importance of robust security measures in organizations dealing with high-value assets and the need for comprehensive testing of defenses and incident response plans. Cyber attacks on fine art organizations remain relatively rare but can have significant consequences, such as access to payment information of wealthy individuals and potentially exposing valuable pieces’ storage locations.

Art auctions are not immune to cyber threats, as demonstrated by previous attacks on the Metropolitan Opera and American museums. These incidents highlight the importance of ensuring confidentiality, integrity, and availability of data in cybersecurity practices. While the motives behind such attacks may vary, the impact on auction items’ prices and visibility underscores the need for vigilance in protecting critical assets. Overall, the Christie’s cyber attack serves as a reminder of the evolving threat landscape and the necessity for organizations to prioritize cybersecurity measures to safeguard their operations and reputation.