SOTHEBY'S

Sotheby's reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-10-15. 10 Massachusetts residents were affected.

Sotheby’s notified consumers on October 15, 2025, of a data breach discovered on July 24, 2025, where an unknown actor removed data from its environment. The incident involved personal information including names and government identifiers. Sotheby’s notified federal law enforcement and regulatory authorities, and is offering 12 months of credit monitoring via TransUnion. The investigation was completed by September 24, 2025.

Sotheby's reported an external system breach (hacking) on July 24, 2025, affecting 2 Maine residents. Data exfiltrated included names, SSNs, and financial account information. Sotheby's investigated with third-party specialists and federal law enforcement. Notices were sent on October 15, 2025, offering 12 months of credit monitoring via TransUnion.

Sotheby’s notified the New Hampshire Attorney General on October 15, 2025, of a data event affecting one NH resident. On July 24, 2025, Sotheby’s became aware that data appeared to have been removed by an unknown actor. The affected data included the resident's name and Social Security number. Sotheby’s engaged third-party specialists, worked with federal law enforcement, and offered 12 months of credit monitoring via TransUnion.