Breach Disclosure: Artsy

In 2018, art consignment website Artsy experienced a data breach that would ultimately end up being offered for sale on various hacking forums by notorious breach broker Gnosticplayers. Exposed information includes the email and IP addresses, usernames, and salted SHA-512 hashed passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The data stolen from Artsy was initially offered for sale on dark web marketplace Dream Market in February 2019. The breach was bundled with data stolen from 16 organizations (for a total of 620 million user records), including MyFitnessPal, 500px, HauteLook, and WhitePages. The breach has been made available individually on RaidForums, for free.

Figure 1: Free download of the Artsy breach offered on RaidForums.

In response to this breach, Artsy notified affected users via email, and conducted an investigation into the root cause of the breach. The company also reported that additional security measures were put in place, although they did not specify what updates were made.