Selling Through the Christie’s Cyberattack

On Thursday night, as Christie’s was getting ready to sell more than $800 million of art over the course of a week, the august auction house’s website went down. “Site Under Maintenance,” said the mysterious note on a temporary Amazon CloudFront page to which visitors had been redirected. “Our site is undergoing maintenance and will be back shortly.”

It’s not unusual for an auction website to malfunction, or occasionally go down during moments of high usage. But the timing was, to put it mildly, inconvenient. Much of the action of an auction is orchestrated ahead of time, with guarantees placed to ensure work will sell, and advisers working with clients to strategically plan their bidding. And because auction houses have pretty much stopped distributing the old doorstop print catalogs in the last decade, much of this happens by texting links to lots on an auction house’s website.

The site is also integral during the sale. The pandemic forced the last old Luddite holdouts to embrace online bidding, and many out-of-towners prefer that to traveling to New York—some locals prefer it to putting on a suit and schlepping to Christie’s at Rockefeller Center or York Avenue, home of Sotheby’s. Last year Christie’s CEO Guillaume Cerutti said that 80% of all bids across sales at the house were placed online, up from 45% in 2019.

Days before the sale, Christie’s was staring down the prospect of holding auctions without an auction house website—surely the first time one of the major houses has attempted a sale without a web presence since the dial-up days of the ’90s. By Friday, with the site still down, a spokesperson told The New York Times, in vague terms, that a “security issue had affected some of the company’s systems, including its website.” After maintaining a holding screen all day Saturday that said “We’ll be right back,” the brass changed the text to something a bit more dire.

“Important information: We apologise that Christie’s is currently offline. We are working to resolve this as soon as possible and regret any inconvenience,” it read.

Many sources wondered aloud if the house would have to cancel the sales—a drastic measure that did not happen in the months after September 11, 2001, or in the days after the COVID lockdowns in 2020. On Sunday, with the site still down, Cerutti emailed clients with his decision: The sales would proceed as planned, website or no website, in the Rockefeller Center salesroom, and through that old-fashioned technology, the telephone.

“I want to assure you that we are managing this incident according to our well-established protocols and practices, with the support of additional experts,” Cerutti said. “This included among other things the proactive protection of our main website by taking it offline.”

The tech team had succeeded in accessing the bones of Christie’s Live, a digital platform that allows registered bidders to remotely raise a paddle that will then be tallied in the salesroom. A temporary holding site had the catalogs available to peruse in PDF form. But as specialists spent the weekend following up with clients planning to bid, many of those clients indicated that they would rather avoid whatever was happening with Christie’s on the internet and just talk to a human being.

“There’s always an important in-person element to our sales,” Bonnie Brennan, president of Christie’s Americas, said Wednesday. “People had already been in the exhibitions, people had already been sent all the condition reports and catalogs. And the in-person is so important to it. Yes, digital has grown our audience, but we’ve been doing this for 250 years.”

Christie’s declined to comment on the nature of its tech woes.

“Generally speaking, it’s possible to recover quite quickly from most types of cyberattacks—except for ransomware,” says Brett Callow, a threat analyst at the cybersecurity firm Emsisoft. “So the delay in Christie’s recovery in this case would imply that this could well be a ransomware attack.”

Such breaches usually come in two parts, he says. “Firstly, the attackers, after gaining access to the network, extract a copy of the data, and they then encrypt or lock the computers from which that data was extracted.”

Then they demand a ransom to get it back.

In 2023, ransomware payments hit an all-time high as $1 billion was paid out globally to the hackers who succeeded in data breaches, according to the blockchain analysis firm Chainalysis. Ransomware group LockBit, allegedly headed by the notorious Russian cyber-pirate Dmitry Yuryevich Khoroshev, has extorted over $500 million from victims, and recently hit Boeing with a $200 million ransom demand after scooping up its assets and blasting it online. Boeing refused to pay, so LockBit released all the data. Khoroshev has been charged with 26 counts related to conspiracy to commit fraud, intentional damage to a computer, and extortion, and is currently a fugitive.