British art auction house Christie, Manson & Woods, known as Christie's, faces a 280 million won ($189,000) penalty surcharge for leaking the personal information of 620 Korean clients after its system was hacked through a voice phishing scheme, the Personal Information Protection Commission said Thursday.
At a plenary meeting held the previous day, the commission imposed the fine along with an additional 7.2 million won in fines for violations of Korea’s data protection law. It also ordered the company to disclose details of the sanctions on its website.
The breach occurred in May 2024, when the company’s website was hit by a cyberattack ahead of a New York auction.
The commission said the incident stemmed from a help desk employee who was deceived by a hacker and granted access to the company’s personal information processing system.
The commission said that the help desk staff failed to follow procedures to verify whether the requester was an employee, reissued a password and changed the phone number linked to the account to that of the hacker.
The Korean clients' leaked data included sensitive personal details such as names, nationality, addresses and identification numbers.
The information had reportedly been stored without encryption, and identification numbers were collected and retained for identity verification without a legal basis.
The commission also noted that although Christie’s became aware of the breach on May 18, 2024, it failed to report the incident within the legally required 72 hours without a valid justification, only notifying authorities nearly two weeks later.
forestjs@heraldcorp.com
