HackingRetail & ConsumerRetailCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
SOTHEBY'S
bd_84da0953b8865c3d · schema v1 · pii pii-v1
Full breach record for SOTHEBY'S →On July 24, 2025, Sotheby's discovered that certain data had been removed from its environment by an unknown external actor. A comprehensive data review was completed around September 24, 2025. The personal information of 2 Maine residents was affected, including names, Social Security numbers, and financial account information. Sotheby's worked with federal law enforcement, notified regulators, and offered 12 months of complimentary credit monitoring via TransUnion.
Maine clockDiscovered Jul 24, 2025 → Filed with AG Oct 15, 202583d ⏱ ME AG >30d12 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_4bd73b04199aa29bVermont State AGfiled 2025-10-15Verified
- bd_9d993dd442d3ccbaNew Hampshire State AGfiled 2025-10-15Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2e46843d-f16d-489d-905a-efee2175e06b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 15, 2025
- Raw hash
- d03e794521455461081cc5e0c300151b3b56173ce7f7b6dbf275e660a8b666c6
Reporting entity
- Name
- SOTHEBY'Snorm: sotheby s
- Domain
- sothebys.com
Victim entity
- Name
- SOTHEBY'Snorm: sotheby s
- Domain
- sothebys.com
- Industry
- Retail & Consumerllm
Incident
- Discovered
- Jul 24, 2025
- Materiality determined
- Sep 24, 2025
- Notification sent
- Oct 15, 2025
- Affected individuals
- 2
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Written notice provided to Maine Attorney GeneralWorking with federal law enforcement
Compliance
- Time to disclose
- 12 weeks(83 days from discovery to filing)
- Compliance flags
- ME AG >30d · 83dME resident >60d · 83d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 24, 2025→ Filed with AG: Oct 15, 202583d 30 days (soft) ME AG >30d Maine Discovered: Jul 24, 2025→ Notified: Oct 15, 202583d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.