A group of hackers auctioned off the personal data of clients of Christie’s, an art sales giant, on June 3.
Christie’s, the largest art sales company ($6.2 billion in turnover in 2023) was the victim of a cyberattack last May. A new hacker group, RansomHub, claimed responsibility for the attack on its darknet site on May 26, stating that they were in possession of “ sensitive personal information of at least 500,000 customers across the planet “. An extract of this stolen data was posted online as proof.
In this situation, the victim company usually enters into a negotiation with the cybercriminals in the hope of lowering the ransom demanded. However, the talks having led to no agreement, the RansomHub hackers simply decided to auction the stolen data on June 3. The files have already been sold, according to the cybercriminals.
“ We tried to come up with a reasonable solution, but they [Christie’s] stopped communicating with us. If this information is published, they face heavy fines under the GDPR. Their reputation will be ruined among their customers, since they don’t care about their privacy » we can on the RansomHub website.
Identity data stolen by hackers
Contacted by the specialized media The Register, the Christie’s company responded: “ Our investigations determined that the group accessed customer names and, for some, other personally identifiable information. There is no evidence that financial or transactional records were stolen for any client. “.
Data auctioning is not the most common technique for ransomware groups. These are generally practices commonly found on hacker forums. Ransomware attackers prefer to put everything online to destroy the company’s reputation – and maintain this image of lawless cybercriminals – or sell to other interested organizations in the cybercrime world. It’s possible that the hackers already had buyers in mind. The sale price was not revealed.
Subscribe to Numerama on Google News so you don’t miss any news!