ArtNexus Database Exposure Allegedly Reveals Collector Data and Payment Tokens
Summary
An actor posting as exfilar claims ArtNexus left a database publicly readable, exposing account, contact, purchase and payment-token data. The report says the exposure is still live, but the claim is unverified.
Key points
- An actor posting as exfilar claims an ArtNexus backend database was publicly readable without authentication.
- The alleged dump contains 3,314 unique email addresses and 3,455 user accounts.
- It reportedly includes 834 physical addresses, phone numbers and purchase records across 37 countries.
- Payment source tokens and private buyer-seller negotiation messages are also alleged to be in the dump.
- The report says the exposure is still live; the claim remains unverified.
Article Details
- Victim Organization
- ArtNexus
- Incident Type
- Alleged publicly readable backend database exposure due to no authentication
- Data Types Exposed
- Email addresses
- User accounts
- Physical addresses
- Phone numbers
- Payment source tokens
- Purchase records
- Private buyer-seller negotiation messages
- Affected Records
- The claim cites 3,314 unique email addresses, 3,455 user accounts, and 834 physical addresses; these counts may overlap.
- Operational Impact
- The exposure was reported as still live, but the claim remains unverified.
- Claim Status
- claimed