The incident, which Christie’s had previously referred to as a “technology security incident,” shut down its website for ten days before and during the house’s marquee New York sales.

The cyber-extortion group RansomHub claimed responsibility for the cyberattack on May 27. A dark-web message from the group also said it “attempted to come to a reasonable resolution,” but the auction house cut off communication halfway through negotiations. Christie’s emailed its clients on May 30 acknowledging the cyberattack, but said only identification data, not financial or transaction data, had been stolen.

The complaint filed in the Southern District of New York on June 3 alleges that Christie’s was unable to protect the “personally identifiable information”, or PII, of its clients, of which is estimated to be at least half a million current and former buyers in its databases. The complaint describes the breach as “a direct result of [Christie’s] failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect consumers’ PII from a foreseeable and preventable cyberattack”. The complaint filed also alleges that “data thieves have already engaged in identity theft and fraud and can in the future commit a variety of crimes” using the stolen information, which it said includes full names, passport numbers, as well as other sensitive details from passport scans, including dates of birth, birth places, genders, and barcode-like “machine-readable zones” or MRZs.

The complaint alleges the breach of data resulted in multiple “concrete injuries,” including invasion of privacy; lost time and opportunity costs from “attempting to mitigate the actual consequences of the Data Breach.”

The lawsuit also states that Christie’s clients are also at risk of multiple forms of identity theft, including the possibility of bad actors opening fraudulent financial accounts and loans in the names of exposed individuals; illegally securing government benefits, or even acquiring identification with alternate photographs and “giving false information to police during an arrest”.

The only plaintiff currently named in the class-action lawsuit is Efstathios Maroulis, who is defined in the complaint as a resident and citizen of Dallas, Texas. Profiles on Instagram and LinkedIn matching Maroulis’ name and location said the individual was the founder and CEO of dental enterprise software company Jarvis Analytics, as well as the founder and CEO of digital marketing company Mesa Six. Jarvis Analytics was acquired by dental and medical supply company Henry Schein in 2021.

Messages from ARTnews to the Instagram and LinkedIn profiles believed to belong to Maroulis did not result in a response.

Maroulis’s complaint also argues that hackers with at least two forms of PII can use those illegally acquired details in combination with publicly available data found elsewhere to “assemble complete dossiers on individuals” with “an astonishingly complete scope and degree of accuracy”. The Art Newspaper, which first reported the lawsuit, noted that these dossiers, called “fullz” in hacker circles, “typically bring considerably higher prices on the dark web than partial records thanks to their considerably higher utility in perpetrating identity theft.”

The lawsuit’s definition of the scope of alleged harm as a result of the cyberattack also includes data brokers. Maroulis’ complaint alleges that clients affected by the data breach at Christie’s can no longer voluntarily sell their own personal data at full value as a result of its exposure from RansomHub, and that information “may also fall into the hands of companies that will use [it] for targeted marketing” without their consent or permission.

According to a document filed on June 5, United States District Court Judge Jesse M. Furman has ordered that counsel for all parties appear at a initial pre-trial conference at the court on September 10.

The auction house also filed a breach notification with the office of California Attorney General Rob Bonta. The letter states that Christie’s discovered it was the victim of a cybersecurity incident on May 9, engaged external cybersecurity experts, and notified law enforcement. The letter also states the auction house is offering a “complimentary twelve-month subscription to CyEx Identity Defense Total,” an identity theft and fraud monitoring service which would notify any changes to Experian, Equifax, and TransUnion credit reports.

The letter is signed by Christie’s chief operating officer Ben Gore. CyEx’s website states the reference value of “Identity Defense Total” at $19.99 per month.

A Christie’s spokesperson declined to comment to ARTnews on the lawsuit. When asked whether other breach notifications had been filed, a spokesperson wrote in an email, “Breach notifications have been issued to the appropriate authorities in line with continued compliance with GDPR and other relevant national and state regulations.”

Milberg Coleman Bryson Phillips Grossman, the law firm representing Maroulis, also had not responded to a request for comment from ARTnews by publication.

Despite the cyberattack, the auction house was still able to generate $114.7 million for the Rosa de la Cruz and 21st Century sales and $413 million during its 20th Century Evening sale in New York through bids by phone, in-person, and its online platform Christie’s Live.

News of the class-action lawsuit was first reported by The Art Newspaper. Brett Callow, threat analyst for the New Zealand–based cybersecurity firm Emsisoft, first posted news of the breach notification with the California Attorney General’s office on X.

On June 6, David Voss plead guilty to one charge of forgery and one charge of uttering forged documents, in this case the fake provenance materials he used while operating an art fraud ring between 1996 and 2019. Based in the northern Ontario city of Thunder Bay, Voss oversaw the production of thousands of artworks falsely attributed to Anishinaabe artist Norval Morrisseau. Notably, it was a “paint by numbers” assembly process that helped investigators identify 26 out of 30 suspected works.

According to a statement of facts read in Ontario Superior Court, investigators had identified more than 1,500 forgeries from Voss’ fraud operation and seized nearly 500 so far. Additionally, Voss was stated to have “never met, acquired artwork from or otherwise interacted with, Norval Morrisseau.”

Last March, investigators from the Thunder Bay Police Service and Ontario Provincial Police announced that they had charged eight people on a total of 40 charges for their involvement in the manufacture and distribution of fake paintings, prints, and other artworks attributed to Morrisseau.

Morrisseau, a prolific artist from the Ojibway Bingwi Neyaashi Anishinaabek First Nation, was known for his distinctive Woodland School of Art style. Morrisseau’s work was the subject of a major retrospective at the National Gallery of Canada in 2006, the first staged at the institution for a contemporary Indigenous artist. He died in 2007 at the age of 75 due to complications from Parkinson’s disease.

However, even prior to Morrisseau’s passing, police said there were allegations of people making and selling unauthorized works of art under the Indigenous artist’s name.

The press announcement said the investigation spanned two and a half years, and some of the paintings had been sold for “tens of thousands of dollars”, generating millions in sales.

CBC News reported that an agreed statement of facts detailed how the production of forged artworks was included an assembly-line, “paint by numbers” process and multiple painters enlisted and paid by Voss.

The Globe and Mail reported that Voss “sketched out drawings meant to mimic Mr. Morrisseau’s distinctive style and then annotated each section with letters indicating their ideal colour – ‘G’ for green, ‘B’ for blue, ‘LR’ for light red and so on. He would pass the sketches to hired painters to lay on the prescribed colours, before the works were signed with the Cree syllabic autograph Mr. Morrisseau was known for and backdated, usually to the 1970s.”

Voss’ pencil outlines for these forgeries were later used by forensic analysts at the Canadian Conservation Institute to identify inauthentic works attributed to Morrisseau through digital infrared photography.

The forgeries were sold to auction houses, and distributors across the country but the majority were resold through two auction houses in the small Ontario town of Port Hope. A court statement said that Voss sold 1,500 to 2,000 works to the houses, giving owner Randy Potter a 30 percent cut of sales. During a previous civil court appearance, Potter testified the forgeries usually sold at auction for $1,200 to $7,000 Canadian dollars, but could also sell as much as $30,000 Canadian dollars. Potter died in 2018.

The sheer number of fraudulent Morrisseau works produced by Voss’ ring and the victims in their wake have also been the subject of a documentary called “There are No Fakes” featuring Barenaked Ladies member Kevin Hearn.

Prior reporting in The Globe and Mail also identified two works suspected to be Morrisseau forgeries at the Ontario Legislature and the National Capital Commission: Salmon Life Giving Spawn, removed and seized by police in January, and Circle of Four.

Voss is scheduled to be sentenced in September.

Floris van Schooten’s Still-Life with Ham and Peter Binoit’s Food, Fruit and Glass on a Table had been part of the Louvre’s Nordic collection for several decades and held under the “National Museum Recuperation” programme for stolen works whose owners are unknown, according to France 24. The two paintings had also been on display at the institution since the 1950s.

In 1944, the two paintings were looted by Nazis from a mansion in central Paris owned by Mathilde Javal. After the end of World War II, Javal had officially requested the restitution of her family’s works of art. According to the Louvre museum, evidence of Javal’s request was found in a letter, but the paintings could not be returned due to lack of information about their rightful ownership. The museum also said errors for Javal’s name and their address also added confusion.

After the the van Schooten and Binoit paintings were returned to 48 descendants of Javal, many of the rights holders, as well as their children and grandchildren, gathered at the museum on June 4 before the opening of a public exhibition detailing the family’s experience under the Nazis.

The research necessary to identify the descendants of the rightful owners of six works from the National Museum Recuperation programme, including the paintings by van Schooten and Binoit, was done through a 2015 agreement made by the French ministry of culture and a national organization of genealogy professionals. The research work was done free of charge, according to Le Figaro, which first reported the news.

The Louvre has 1,610 works in its National Museum Recuperation programme, including 791 paintings. They are part of the legacy of approximately 100,000 items that were looted in France mainly from Jewish families during the Second World War. After the war’s conclusion, approximately 60,000 items were returned to the country, with 45,000 returned to their owners. The majority of the 15,000 remaining items, were sold by the state, with national museums like the Louvre trusted with custody of 2,200.

Louvre director Laurence Des Cars told the AFP the case was “a commitment to transmitting memory and a constant reminder to action”.

The law enforcement agency assisted the Metropolitan Police with the recent return of 268 items from a collector in Washington, D.C. The FBI also contacted a buyer in New Orleans via email about two items purchased on eBay.

The email from the FBI agent said they were assisting the Metropolitan Police in its investigation of the British Museum’s missing, stolen, and damaged items. The buyer, Tonio Birbiglia, told the BBC that he bought the two gems from the same eBay account later identified by whistleblower Ittai Gradel as selling items from the British Museum’s collection for as little as $51.

Birbiglia told the BBC that he paid £42 for an amethyst gem depicting Cupid in May 2016, and later purchased an orange scarab-beetle gem for £170.

The BBC reported that neither the FBI, the British Museum, nor British police requested further information from Birbiglia, and he is no longer in possession of these items.

The British Museum announced last August that ancient gems, jewelry, and other items from its collection were missing or damaged. Many of the items had not been cataloged or photographed by the museum.

The institution’s press release did not mention the name of the staffer who was fired, but the individual was soon identified by media as senior curator Peter Higgs. The museum is currently suing Higgs in a civil case. According to court documents, the British Museum alleges the thefts from its storerooms took place over a decade, and sales of the ancient gems to “at least” 45 buyers generated an estimated £100,000 in total.

Higgs has not been charged or arrested, and his family has denied the allegations.

The impact of the thefts at the British Museum has been immense, with resignations, testimonies at parliamentary committees, an independent review, as well as renewed calls for the repatriation of high-profile items: they include director Hartwig Fischer’s having immediately stepped down instead of departing early in 2024 as was previously announced; the subsequent departure of deputy director Jonathan Williams; the independent review’s 36 recommendations for the museum’s security, governance, and record-keeping operations; as well as plans for a complete documentation of the museum’s collection in five years at a cost of $12.1 million.

The lack of cataloging of the museum’s collection also prompted the creation of a web page requesting the public’s assistance in locating some of the missing and stolen items. The BBC also reported that in some cases, collectors have agreed to donate items to the British Museum so that staff can assess if they came from its collection.

Of the 1,500 missing, stolen, and damaged items, the Museum announced earlier this month it had recovered 626 pieces, and located 100 more that had not yet returned to the institution.

The British Museum did not respond to a request for comment from ARTnews. The FBI cited “longstanding DOJ policy” and wrote in an email to ARTnews “the FBI neither confirms nor denies an investigation and has no further comment.”

“It makes you wonder who did it. Whoever did that was intentional about timing,” art adviser Elizabeth Fiore told ARTnews. Then she sounded a hopeful note. “There are still great pieces of art, and still buyers to buy them.”

When ARTnews reached out to Christie’s about the matter on May 10, a spokesperson said a “technology security issue” was the cause of its website being down. “We are taking all necessary steps to manage this matter, with the engagement of a team of additional technology experts,” a spokesperson said. “We regret any inconvenience to our clients and our priority is to minimize any further disruption. We will provide further updates to our clients as appropriate.”

The auction house declined to say whether the issue was due to hackers or a cyberattack. The house also did not respond to inquiries about whether any of the private or financial data it collects about its clients had been accessed or stolen, but told the Wall Street Journal it would inform customers if that had occurred.

“We’re still working on resolving the incident, but we want to make sure we’re continuing our sales and assuring our clients that it’s safe to bid,” Christie’s chief executive Guillaume Cerutti told the Wall Street Journal.

Still, advisers told ARTnews that the ability to take part via Christie’s website is a big concern for consignors.

“Some collectors prefer to bid online,” art adviser David Shapiro told ARTnews. “If they cannot do so, this will reduce the number of bidders for certain lots, which has the potential to affect attainable prices.”

Cerutti asserted to the Wall Street Journal that Christie’s has “gone into overdrive” to reassure some of the world’s wealthiest collectors that the New York sales would go on without further issues. The auction schedule for its New York sales of Impressionist, modern, and contemporary art remained unchanged. Only a watch sale in Geneva was postponed from May 13 to today.

In a slate of evening sales with few big names, Christie’s has one of the few with the estates: a collection of Rosa de la Cruz, estimated at $25 million. The Miami arts patron died in February, and the works from her private foundation include a Felix Gonzalez-Torres light sculpture with an estimate of of $8 million to $12 million.

Competing auction houses Sotheby’s and Phillips have not reported similar attacks on their websites.

Some collectors said they were intimately familiar with outages like the one Christie’s is currently facing. American businessman and ARTnews Top 200 Collector Bruce E. Toll said he had purchased modernist works at auction and that he had personal experience with cyberattacks, after one targeted his investment company, BET Investments, in 2019. Toll told ARTnews that the experience cost an insurance company millions to deal with, due to BET Investment’s cyber liability policy. “I paid the ransom within 24 hours,” he explained. “What was I going to do, go out of business?”

Toll, who toured all the auction houses in person ahead of the sales this week, was shocked that Christie’s website had been down for several days. “I can’t believe it,” he said. “When I hang up with you, I’m going to call them. I’m going to say: Why didn’t you pay the ransom? It’s the dumbest thing I’ve ever heard of.” (When ARTnews specifically asked if Christie’s received a ransom demand, the house did not respond and reiterated that it had experienced a “technology security incident” on May 9.)

He had a simple theory for why Christie’s hasn’t used the words “cyberattack” or “hacker” in its public statements so far: “They’re nervous. They don’t want to be hacked again.”

A Christie’s spokesperson said that Cerutti was unavailable to comment to ARTnews.

Chatsworth House in the English town of Derbyshire had lent A Double Portrait of Sir Peter Paul Rubens and Sir Anthony Van Dyck (1640s) to the Towner Art Gallery for an exhibition focused on works by Anthony Van Dyck, a Flemish Baroque artist.

The oil on wood painting was taken by thieves on May 26, 1979 after a “smash and grab” raid on the gallery’s exhibition. The burglars left several original drawings by Van Dyck that had also been on display and were much more valuable. (Christie’s sold a Van Dyck drawing for $2.1 million in February.)

“Some of the priceless drawings were left and they took this which I suppose looked more expensive,” Alice Martin, head of the Devonshire collections at Chatsworth House, told The Art Newspaper, which first reported the news Friday.

The painting was originally painted in preparation for an engraving and not for display on a wall. After the theft in 1979, it was assumed lost. An art historian spotted A Double Portrait of Sir Peter Paul Rubens and Sir Anthony Van Dyck listed for sale in Toulon, France, and alerted the British country house.

According to The Art Newspaper, the painting was found in the seller’s late parent’s house in the southeast English town of Eastbourne before it was sent to Toulon for sale.

Restoration work included repairing paint that had flaked off and the removable of nicotine stains.

A Double Portrait of Sir Peter Paul Rubens and Sir Anthony Van Dyck is now back on display at Chatsworth after three years of negotiation, including delays due to the Covid-19 pandemic.

Mayhew-Lewis bought the picture, which the UK’s National Crime Agency says could be worth “millions of pounds,” in 2017 for £1.6 million. Later, another unidentified person used the work as collateral to secure a £5 million loan from a UK-based auction house. 

The work, titled Albert Street, 2009, is currently being held by the house in the event that there is an appeal against the forfeiture. Should the sale proceed, the NCA could walk away with up to 50 percent of the proceeds, with the remaining share going to the UK’s Home Office.

The record for an Auerbach at auction was achieved last year when Sotheby’s London sold his 1969 canvas Morning Crescent for £5.56 million ($7.1 million). The Courtauld Gallery in London just closed a show of Auerbach’s large scale portraits in charcoal, and a rare cache of his work is among the highlights of satellite exhibitions in Venice that run concurrently with the Venice Biennale.  

Mayhew-Lewis has been on the run since March 2023 after we was convicted of laundering money for organized crime outfits and drug traffickers. The NCA learned about the illicitly purchased work after issuing an amber warning to auction houses and art dealers, warning them “to be wary of money-laundering schemes and other criminal activity connected to fine art.”

In January, the office released a statement advising those who work in the art market to conduct “due diligence checks” so that they could “identify within their business any change in client status and suspicious activity,” including “money laundering, cultural property trafficking, or other criminality.”

Salvator Rosa’s Baroque landscape A Rocky Coast, with Soldiers Studying a Plan was stolen from the Christ Church Picture Gallery March 14, 2020. The two other works stolen that day, Anthony van Dyck’s A Soldier on Horseback (ca. 1617) and A Boy Drinking (ca. 1580) by Annibale Carracci, are still missing. They had been on display at the religious institution since 1768.

The total estimated value of the three artworks is almost $12.4 million (£10 million).

According to the gallery, a man in possession of the Rosa landscape contacted Romanian police. He had sold the other two artworks, but chose to return A Rocky Coast, with Soldiers Studying a Plan to authorities. “The man is being treated as a witness by Romanian authorities and has not been arrested.”

“We’re grateful to the Romanian authorities and Thames Valley Police for their help in retrieving this priceless work and returning it to our gallery,” Christ Church Picture Gallery curator Jacqueline Thalmann said in a statment.

Thalmann called the group of paintings a significant part of its collection, and of “inestimable” significance to British and European culture.

Investigators are working with the Romanian judiciary and police, as well as the European Union Agency for Criminal Justice Cooperation and the European Union Agency for Law Enforcement Cooperation to collect further information.

“It is believed that the other two paintings were sold in Romania and could be anywhere in Europe,” senior investigating officer Detective Chief Inspector James Mather said in a statement.

Both the Christ Church Picture Gallery and Thames Valley Police are asking members of the public with any information that can assist in the return of the two missing artworks to come forward through an online form, quoting reference 43200087031.

News of the Rosa’s return was first reported by BBC News.

Nicholas P. Hatch was arrested for selling counterfeit art in May 2023 and plead guilty to mail fraud. He was sentenced in US District Court in Connecticut and ordered to restitute the $248,600 he made from selling fake paintings to 43 buyers.

Per the criminal complaint filed upon his arrest, Hatch executed his scheme through his company Hatch Estate Services, which advertised prints purportedly made by Max. In reality, the employees at the company had added brushstrokes and phony signatures to reproductions to lend them the appearance of authenticity. The FBI’s New Haven unit began its investigation in December 2021, following a tip from one of Hatch’s employees about suspected mail fraud. 

Hatch reportedly carried out his scheme using several aliases—Alex Cassellucci, Jeremy Ruiz, and Liam—and a slew of shell companies including Hatch Estate Services, Lions Gate Auctions, and Indian Head Auctions.

The fraudulent Max paintings were sold for prices between $1,325 and $2,833, and some were even accompanied by forged certificates of authenticity. Had the works been legitimate, they would have been a steal: authentic prints and paintings by Max typically fetch between $10,000 to $20,000 at auction. The artist, who is 86 and suffering from dementia, has been embroiled in a separate legal dispute filed by his daughter over the rights to his legacy.

On June 17, Hatch will begin his 14-month prison sentence, with three years of supervised release.

The suspect was charged with money laundering, smuggling, and falsifying documents.

“The arrested person was perfectly aware of the illicit origin of the Egyptian bust seized in the Netherlands,” stated a press release from Spanish authorities.

The press release stated that an investigation began after the Swiss gallery had learned the piece had been linked a Barcelona antiquities dealer with ties to the trade of goods from conflict zones in North Africa and the Middle East. The Swiss gallery had purchased the black granite head from a German gallery.

After the sculpture was given to Dutch police, authorities there sent a document to Spanish police reporting the item had been illegally marketed in Europe. Further investigation showed the granite sculpture had been acquired by the Spanish suspect in July 2015 from an international company based in Bangkok, Thailand.

Most importantly, the investigators were able to prove the Spanish gallery owner had falsified the provenance document for the sculpture and it was not part of a Spanish collection of archaeological objects from the 1970s. This false documentation was also what allowed the piece accepted for sale at the TEFAF art fair.

In an email statement to ARTnews, TEFAF Head of Fairs Will Korner said, “We are glad to hear of the progress in this case. We have been well aware of it since the start, and work closely every year with Dutch and international police forces, exhibitors, the Art Loss Register and our vetting committees. All these work to ensure every object and provenance of antiquities is reviewed, and as such this was removed before the fair opened in 2022.”

While police did not name the suspect in public documents, Lynda Albertson, the CEO of the Association for Research into Crimes Against Art, has claimed in a blog post that the individual in question is Jaume Bagot Peix, operator of the J. Bagot Arqueología gallery in Barcelona, Spain.

In 2018, Vanity Fair Spain published a feature detailing how Bagot Peix was under police scrutiny for allegedly acquiring artifacts looted from Libya in a scheme that financially benefited the Islamic State.

The arrest surprised art crime expert Christopher Marinello, who founded the firm Art Recovery International after working at the Stolen Art Database for more than seven years.

“There has been a lot of publicity about US antiquities dealers being arrested for falsifying provenance but this Spanish dealer apparently didn’t get the memo that you can’t get away with this,” Marinello told the National.

“What stands out is that the police in the Netherlands worked really well with the Spanish police, so it was good to see international co-operation, which happens very rarely,” Marinello added.

In an email to ARTnews, art and cultural property lawyer Yves-Bernard Debie said his Brussels firm represented Bagot and his gallery. “We can confirm that our client has not been arrested. The information that is being disclosed is false.” 

Updated, April 17, 2024: The sculpture was not at the most recent TEFAF Maastricht art fair, but the sessions in 2020 and 2022. Lynda Albertson is the CEO of the Association for Research into Crimes Against Art, not its president. The research-based organization work on tracking illicit material.

Updated: April 17, 2024: Addition of comment from Will Korner, TEFAF Head of Fairs and correction the sculpture was set to be offered at the art fair, but removed before its opening.

Updated: April 18, 2024: Addition of comment from art and cultural property lawyer Yves-Bernard Debie.