Breach Disclosure: Artvalue

In June 2019, Artvalue, a fine art auction site, was breached and their databases were compromised. A report by ITSecurityNews stated that approximately 158,000 subscribers were compromised. The list was in a flat text file on their website, and contained names, usernames, email addresses and md5 passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media.

Details

The website has an open web directory when navigating to artvalue.com. Although not confirmed, this is likely where the text file was stored and served. The directory contents as of 19 July 2019 are as follows:


mardi 21 juin 2016    11:48   5572217344 artvaluestat.bak
lundi 11 juillet 2016    11:29      7985664 ArtvalueStat.bak_old
samedi 20 janvier 2018    01:37        15872 ArtvalueStat_LOG
mercredi 26 septembre 2018    17:47        <dir> install
jeudi 18 janvier 2018    10:32 155814168822 kpax.rar
mardi 13 février 2018    11:10        <dir> pchealth
vendredi 19 juillet 2019    00:35        <dir> ProdGuideMayer
dimanche 14 janvier 2018    01:31   1595640320 ProdGuideMayer_LOG
samedi 20 janvier 2018    01:34   2824174080 qwe.rar
vendredi 30 octobre 2015    15:36        <dir> sp3
mercredi 26 septembre 2018    17:40        <dir> www_BK20091223
mercredi 26 septembre 2018    17:40        <dir> www_BK20100105
mercredi 26 septembre 2018    17:40        <dir> www_BK20100109
mercredi 26 septembre 2018    17:40        <dir> www_BK20100115

The web server is IIS (Internet Information Services) and has port 3389 (used for RDP) open to the world. Given the security posture of the website and the open web directories, it's not surprising someone found a way into the website.