(Credit: Lev Radin/Shutterstock.com)
The international auction house Christie's has confirmed it has suffered a data breach where hackers accessed its systems and took clients' personal data.
The ransomware group known as RansomHub has taken responsibility for the attack, according to a screenshot from the group's dark web page shared by Brett Callow, threat analyst at antivirus tech firm Emsisoft.
"While utilizing access to Christies [sic] network we were able to gain access to their customers [sic] sensitive personal information," RansomHub says in its post, adding that full names, ID numbers, birthdates, and other data on 500,000 Christie's clients are supposedly in its possession.
"We attempted to come to a reasonable resolution with them but they ceased communication midway through," the group continues. The hackers allege that if Christie's refuses to negotiate on a ransom, a leak could result in "heavy fines from the GDPR." The GDPR, or General Data Protection Regulation, is an EU data protection law that requires firms to disclose cyberattacks if user information is at risk.
Christie's has confirmed a data breach occurred, but hasn't shared whether it has been in conversations with RansomHub. "Our investigations determined there was unauthorized access by a third party to parts of Christie’s network," the auction house's VP of Communications, Edward Lewine, tells The New York Times in a statement.
"The group behind the incident took some limited amount of personal data relating to some of our clients," Lewine continued. Christie's says its financial records have not been compromised and is currently in the process of alerting relevant government agencies and regulators about the incident and will also warn clients whose data was exposed.
According to cybersecurity firm SocRadar, RansomHub has the hallmarks of a "traditional Russian ransomware setup." The group recently claimed a connection to the UnitedHealth breach at subsidiary Change Healthcare and may be linked to the hacker group ALPHV.
RansomHub has broadly said on its own site that its only motivation is money and doesn't want its hackers targeting former Soviet Union nations, China, Cuba, North Korea, or any nonprofit organizations.