Christie’s Fined $193,600 for Data Breach Affecting South Korean Customers British auction house Christie’s has been fined 287 million won ($193,600) by South Korea’s Personal Information Protection Commission (PIPC) following a data breach that exposed the personal information of 620 South Korean members. The leaked data included names, addresses, and resident registration numbers. The breach occurred after a Christie’s employee granted unauthorized access to the company’s personal information processing system to a malicious actor. The PIPC criticized Christie’s for failing to implement adequate security measures, such as encrypting customer data, and for delaying notification of the incident beyond the mandatory 72-hour reporting window. The fine underscores regulatory scrutiny over data protection failures, particularly in cases involving sensitive personal information. The incident highlights vulnerabilities in third-party access controls and the importance of timely breach disclosures under privacy laws.

The Vermont Office of the Attorney General reported that Christie’s experienced a data breach on May 9, 2024, when an unauthorized actor accessed their systems and copied certain files, which potentially included personal information. The breach notification was reported on June 7, 2024.