Christie's Ransomware Attack

On May 9, 2024, Christie's was hit by a ransomware attack that crippled its digital operations days before the prestigious spring auction season. The attack took Christie's website offline, disabled online bidding platforms, and forced the company to delay several major auctions. The stolen data included client names, addresses, passport copies, bank account details, and provenance records for high-value artworks. The breach was particularly damaging given Christie's handling of ultra-high-net-worth clients.

Christie's is one of the world's oldest and largest auction houses, established in 1766 in London. Annual sales exceeding $7 billion. Client base includes the world's wealthiest individuals and institutions.

The ransomware group gained access through compromised third-party vendor credentials. They spent approximately two weeks mapping the network and exfiltrating data before deploying ransomware.

Professional ransomware group with focus on hospitality sector. Demonstrated patience in network reconnaissance before deploying encryption across all systems including backups.

Attribution sources

• BleepingComputer
• Media reports

Countries affected

• Global

Data types

• Client names
• Addresses
• Phone numbers
• Passport copies
• Bank account details
• Art collection records
• Provenance documentation
• Bidding histories

Sales disruption during critical spring auction season. Reputational damage with ultra-high-net-worth client base.

Public reaction

Significant concern in the art world about client privacy and data security. Ultra-wealthy collectors expressed alarm about exposure of their art holdings.

Political impact

Discussions about cybersecurity requirements for major auction houses handling sensitive client data.

UK ICO investigation into data protection practices.

Civil lawsuits

• Potential lawsuits from affected high-net-worth clients

Policy changes

• Enhanced data protection requirements for art market participants

Security improvements

• Complete IT security overhaul
• Enhanced third-party vendor security reviews

Significance

Demonstrated that even the most prestigious cultural institutions with the wealthiest clientele are vulnerable to ransomware.

Legacy

Sent shockwaves through the art world, leading to industry-wide reassessment of cybersecurity.

Publishing organisations

• BleepingComputer

Website and systems restored over several weeks. Client notification completed.

References

1. [1]BBC News: Christie's ransomware attack
2. [2]The Art Newspaper: Christie's cyberattack
3. [3]BleepingComputer: Christie's hack