Play Ransomware Group Operations

Play ransomware operates a double extortion model exploiting public-facing application vulnerabilities. Notable for targeting municipal governments where essential city services including water billing and tax collection were disabled for extended periods.

Christie's is one of the world's oldest and largest auction houses, established in 1766 in London. Annual sales exceeding $7 billion. Client base includes the world's wealthiest individuals and institutions.

The ransomware group gained access through compromised third-party vendor credentials. They spent approximately two weeks mapping the network and exfiltrating data before deploying ransomware.

Professional ransomware group with focus on hospitality sector. Demonstrated patience in network reconnaissance before deploying encryption across all systems including backups.

Attribution sources

• BleepingComputer
• Media reports

Countries affected

• Global

Data types

• Government records
• Healthcare data
• Student records
• PII

Sales disruption during critical spring auction season. Reputational damage with ultra-high-net-worth client base.

Public reaction

Significant concern in the art world about client privacy and data security. Ultra-wealthy collectors expressed alarm about exposure of their art holdings.

Political impact

Discussions about cybersecurity requirements for major auction houses handling sensitive client data.

UK ICO investigation into data protection practices.

Civil lawsuits

• Potential lawsuits from affected high-net-worth clients

Policy changes

• Enhanced data protection requirements for art market participants

Security improvements

• Complete IT security overhaul
• Enhanced third-party vendor security reviews

Significance

Demonstrated that even the most prestigious cultural institutions with the wealthiest clientele are vulnerable to ransomware.

Legacy

Sent shockwaves through the art world, leading to industry-wide reassessment of cybersecurity.

Publishing organisations

• BleepingComputer

Website and systems restored over several weeks. Client notification completed.

References

1. [1]CISA Advisory: Play ransomware
2. [2]FBI Flash Alert