Loading story…
Sotheby's, a leading international auction house specializing in fine art and luxury items, experienced a significant data breach on July 24, 2025. The company confirmed that threat actors gained unauthorized access to its systems and exfiltrated sensitive data, including full names, Social Security numbers, and financial account information. The breach was detected on July 24, prompting Sotheby's to launch an immediate investigation to determine the scope and nature of the compromised data. The investigation, which lasted approximately two months, involved a thorough review of the stolen information to identify the affected individuals. According to filings with the Maine Attorney General's Office, at least two residents of Maine and two of Rhode Island were directly impacted, though the total number of affected individuals remains undisclosed. Sotheby's has not publicly identified the perpetrators behind the attack, and no ransomware group has claimed responsibility as of the latest reports. The company emphasized its ongoing commitment to cybersecurity, stating that it maintains layered defenses, strict access controls, secure connections, and advanced threat protections. Regular patching, incident response testing, vendor vetting, and workforce training are part of Sotheby's security posture. Despite these measures, the attackers were able to bypass defenses and access sensitive data. In response to the breach, Sotheby's is offering 12 months of credit and identity monitoring services through TransUnion to those affected. The company has pledged to review and enhance its security safeguards to prevent future incidents. Sotheby's has so far only reported the breach to the Maine Attorney General, with no filings found in other state data breach portals at the time of reporting. The incident follows a similar attack on Christie's, another major auction house, which was targeted by ransomware actors the previous year. Sotheby's has previously faced security incidents, including malicious code planted on its website to steal payment information. The breach highlights the ongoing risks faced by high-profile organizations handling sensitive client data, particularly those serving high-net-worth individuals. The financial and reputational impact of the breach is still being assessed, as the company continues to investigate and respond to the incident. Sotheby's has not disclosed whether an extortion demand was made or if any ransom was paid. The breach underscores the importance of robust cybersecurity measures and transparent communication with affected clients in the wake of data theft incidents.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In mid-October 2025, Sotheby’s publicly disclosed the July breach through media reporting and regulatory notifications. The company said it was notifying affected employees and offering 12 months of identity protection and credit monitoring through TransUnion.
After roughly two months of investigation, Sotheby’s determined that the breach affected employees rather than customers. The stolen information included sensitive personal and financial data such as Social Security numbers.
Sotheby’s detected a cyberattack on July 24, 2025, and began investigating the incident with cybersecurity experts and law enforcement. The attack resulted in unauthorized access to and theft of sensitive data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
Harrods, the renowned London-based luxury retailer, has confirmed a significant data breach affecting 430,000 of its customers after a third-party supplier was compromised by cybercriminals. The company began notifying affected customers on September 26, informing them that their personal data had been accessed during the supplier breach. The stolen data includes basic personal details such as names and contact information, but does not encompass passwords or financial data, according to Harrods' official statements. Some records also contained marketing-related information, including Harrods membership tier levels and affiliations with co-branded cards, though the retailer believes this information would be difficult for unauthorized parties to interpret accurately. Harrods emphasized that its own internal systems were not targeted or compromised in the incident, and the breach was isolated to the unnamed third-party provider. The company has received direct communications from the threat actor responsible for the breach but has stated it will not engage with them. Harrods has reported the incident to all relevant authorities and is cooperating fully with ongoing investigations. The retailer has also reassured customers that the incident is unrelated to a previous cyberattack earlier in the year, which was attributed to the Scattered Spider group. In that earlier event, Harrods successfully blocked the attackers from accessing its systems, while other retailers such as Marks and Spencer and Co-op were also targeted. The current breach was first reported by UK media outlets after Harrods began customer notifications. The company operates a comprehensive e-commerce platform serving international customers, making the exposure of customer data particularly concerning. Harrods has not disclosed the identity of the compromised supplier, citing ongoing investigations and containment efforts. The company’s focus remains on supporting affected customers and maintaining transparency throughout the incident response process. No evidence has been presented to suggest that the compromised data has been used for fraudulent purposes at this time. Harrods has reiterated its commitment to data security and is reviewing its relationships with third-party suppliers to prevent similar incidents in the future. The breach highlights the ongoing risks associated with supply chain security in the retail sector. Customers have been advised to remain vigilant for potential phishing attempts or scams leveraging their exposed information. The incident underscores the importance of robust third-party risk management and timely communication with affected stakeholders.
Jun 29, 2026
Artisans’ Bank disclosed a data security incident after detecting suspicious activity in an employee email account on March 20, 2024 and determining that an unauthorized actor had access to a limited number of employee mailboxes between January 24 and March 20, 2024. The bank said the exposed information varied by individual and may have included names and other personal data found in affected emails and files; by May 30, 2024, it concluded that some individuals’ information was potentially accessed or acquired. Artisans’ Bank said it secured its email tenant, reviewed relevant content to identify affected people, and offered **24 months** of complimentary Experian IdentityWorks credit monitoring and identity restoration services, while stating it had no indication of identity theft or fraud tied to the incident at the time of notice. Harvard Pilgrim Health Care separately disclosed a ransomware-related breach affecting systems used to service members, accounts, brokers, and providers after discovering the incident on April 17, 2023. The insurer said an unauthorized party copied data from its systems between March 28 and April 17, 2023, and later determined by August 18, 2024 that the affected files may have contained personal information and protected health information. Harvard Pilgrim said it took systems offline, notified law enforcement and regulators, engaged third-party cybersecurity experts, implemented additional safeguards, and offered **two years** of IDX credit monitoring and identity protection services; it also said it was not aware of misuse of the impacted information when the notice was issued.
Jun 29, 2026