Auction house Sotheby’s disclosed a July data breach

Sotheby’s disclosed a data breach discovered on 24 July 2025 that exposed customer information, including financial details. Investigators spent two months determining what data was stolen and who was affected, with the review completed around 24 September 2025 before the firm began notifying impacted individuals. The personal information exposed varies by individual and can include a name, Social Security number, and financial account information, though the number of affected people has not been disclosed.

Sotheby’s offered 12 months of free identity protection and credit monitoring through TransUnion to those impacted. The breach notification shared with the Maine Attorney General, according to Maine Attorney General, states that the company began notifying affected individuals after completing the review. No cybercrime group has claimed responsibility for the attack.