SOTHEBY'S data breach (2025)

🍁Vermont State AGlinked via multistate filing link · 100%

Filed Oct 15, 2025bd_4bd73b04199aa29b

Sotheby’s notified consumers on October 15, 2025, of a data breach discovered on July 24, 2025, where an unknown actor removed data from its environment. The incident involved personal information including names and government identifiers. Sotheby’s notified federal law enforcement and regulatory authorities, and is offering 12 months of credit monitoring via TransUnion. The investigation was completed by September 24, 2025.

🦞Maine State AG

Filed Oct 15, 2025bd_84da0953b8865c3d

On July 24, 2025, Sotheby's discovered that certain data had been removed from its environment by an unknown external actor. A comprehensive data review was completed around September 24, 2025. The personal information of 2 Maine residents was affected, including names, Social Security numbers, and financial account information. Sotheby's worked with federal law enforcement, notified regulators, and offered 12 months of complimentary credit monitoring via TransUnion.

Affected (this filing): 2

ME AG >30d · 83dME resident >60d · 83d

⛰️New Hampshire State AGlinked via multistate filing link · 100%

Filed Oct 15, 2025bd_9d993dd442d3ccba

Sotheby’s notified the New Hampshire Attorney General on October 15, 2025, of a data event affecting one NH resident. On July 24, 2025, Sotheby’s became aware that data appeared to have been removed by an unknown actor. The affected data included the resident's name and Social Security number. Sotheby’s engaged third-party specialists, worked with federal law enforcement, and offered 12 months of credit monitoring via TransUnion.

Affected (this filing): 1

SOTHEBY'S

Litigation Timing

Sensitive data

Timeline