If there’s one thing wealthy people have access to, it’s lawyers. As a result, a client of Christie’s recently filed an class-action lawsuit against the auction house after it experienced a cyberattack in May.
The incident, which Christie’s had previously referred to as a “technology security incident,” shut down its website for ten days before and during the house’s marquee New York sales.
The cyber-extortion group RansomHub claimed responsibility for the cyberattack on May 27. A dark-web message from the group also said it “attempted to come to a reasonable resolution,” but the auction house cut off communication halfway through negotiations. Christie’s emailed its clients on May 30 acknowledging the cyberattack, but said only identification data, not financial or transaction data, had been stolen.
The complaint filed in the Southern District of New York on June 3 alleges that Christie’s was unable to protect the “personally identifiable information”, or PII, of its clients, of which is estimated to be at least half a million current and former buyers in its databases. The complaint describes the breach as “a direct result of [Christie’s] failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect consumers’ PII from a foreseeable and preventable cyberattack”. The complaint filed also alleges that “data thieves have already engaged in identity theft and fraud and can in the future commit a variety of crimes” using the stolen information, which it said includes full names, passport numbers, as well as other sensitive details from passport scans, including dates of birth, birth places, genders, and barcode-like “machine-readable zones” or MRZs.
The complaint alleges the breach of data resulted in multiple “concrete injuries,” including invasion of privacy; lost time and opportunity costs from “attempting to mitigate the actual consequences of the Data Breach.”
Copyright
© Art News