A cyberattack on one of the world’s foremost art auction houses, Christie’s took its website offline last week, although the incident did not halt scheduled auctions. The attack occurred during a peak auction week, prompting the company to shift all bidding to in-person and phone methods. Despite the disruption, the auctions, featuring an estimated US$578 million in modern and contemporary art, continued as planned.
Christie’s website was down on May 9, with partial functionality restored several days later. The landing page and auction browsing features are operational, but other site aspects remain offline. On May 12, Christie’s CEO Guillaume Cerutti emailed clients about the “technology security issue,” assuring them that auctions would proceed despite the digital setbacks.
The cyberattack has raised concerns about the security of financial data for collectors. Details about the nature of the attack remain scant, but the extended website downtime hints at a potential ransomware incident. There is no confirmation on what data might have been compromised, leaving collectors anxious about the safety of their information.
Christie’s has previously faced cybersecurity issues. In August 2023, an unsecured server exposed images of collections and GPS data indicating the location of about 10 per cent of the pieces. This recent attack underscores the vulnerability of high-profile institutions to sophisticated cyber threats.
Security expert Javvad Malik noted that the incident highlights significant security gaps, especially for organizations dealing with high-value assets. He praised Christie’s for its quick adaptation, setting up alternative bidding methods, and maintaining auction continuity. However, he emphasized the need for comprehensive security measures, regular testing, and a coordinated effort across all departments to build a strong security culture.
Cyberattacks on fine arts institutions are relatively rare but can be highly damaging due to the valuable data involved. The incident at Christie’s follows similar attacks, such as the breach at the Metropolitan Opera of New York in 2022 and a software provider breach affecting several American museums in 2023.
