HackingData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
SOTHEBY'S
bd_4bd73b04199aa29b · schema v1 · pii pii-v1
Full breach record for SOTHEBY'S →Sotheby’s notified consumers on October 15, 2025, of a data breach discovered on July 24, 2025, where an unknown actor removed data from its environment. The incident involved personal information including names and government identifiers. Sotheby’s notified federal law enforcement and regulatory authorities, and is offering 12 months of credit monitoring via TransUnion. The investigation was completed by September 24, 2025.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_84da0953b8865c3dMaine State AGfiled 2025-10-15Candidate
- bd_9d993dd442d3ccbaNew Hampshire State AGfiled 2025-10-15Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-15-sothebys-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 15, 2025
- Raw hash
- 0e995e947b4ea1eb411c95df568e7123964ed391cb9b49de105df36de736ac69
Reporting entity
- Name
- SOTHEBY'Snorm: sotheby s
- Domain
- sothebys.com
Victim entity
- Name
- SOTHEBY'Snorm: sotheby s
- Domain
- sothebys.com
Incident
- Discovered
- Jul 24, 2025
- Materiality determined
- —
- Notification sent
- Oct 15, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified and worked with federal law enforcementNotifying relevant regulatory authorities
Compliance
- Time to disclose
- 12 weeks(83 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.