Sotheby's New comms chief, and more: industry moves for aug. 5, 2026. Claire Bennett The Art Market's Next Chapter: New Appointments, a Leonardo at the Met, and the Great Wealth Transfer A Leonardo has quietly entered the galleries of The Metropolitan Museum of Art, while a series of institutional appointments and funding announcements points to broader shifts across the art trade. Madonna of the Yarnwinder, attributed to Leonardo da Vinci and studio, is now on long-term loan from collector Ken Griffin and hangs in Gallery 609. It is currently the only work by Italian artist Leonardo da Vinci (1452-1519) on view at the museum. The painting's price has not been disclosed, but the market for Leonardo offers a revealing frame of reference. In 1967, the National Gallery of Art paid a then-record $5 million for Ginevra de' Benci, a sum estimated at approximately $50.8 million today. Another version of Madonna of the Yarnwinder carried a £40 million estimate when it was stolen in 2003. The most dramatic comparison remains Salvator Mundi, which sold at Christie's in 2017 for $450.3 million, still the auction record for a painting. The week's personnel changes were concentrated across auction houses and cultural institutions. Natasha Le Bel, formerly global head of communications at Christie's, has been named Sotheby's chief communications officer. Karina Sokolovsky, Sotheby's outgoing communications chief, will take on a leadership position connected to the auction house's strategic growth plan. At Fairfield University, Matt Malone, the former president and editor-in-chief of America Media, has been appointed the institution's first vice president for arts and culture. He will oversee the newly established Division of Arts and Culture. In Philadelphia, Freeman's has named Jelena James senior specialist and head of sale for Old Masters and 19th-Century European Art, bringing more than two decades of international auction experience to the position. Other developments underscore the expanding role of access, technology, and archival stewardship. Berlin's Deutsches Historisches Museum has received funding for Reverse Shot: Images of German Crimes in Europe, a nearly two-year project in which young adults will help develop a bilingual web application examining photographs of crimes committed under German occupation during World War II. In São Paulo, Vermelho now represents the archive of photographer George Love, an important figure in the development of photography as an artistic practice in Brazil and the United States during the 1960s and '70s. The San Diego Museum of Art and the Westmoreland Museum of American Art have each received $75,000 after winning the second annual Bridgemaker Prize for expanding public access and community engagement. Their recognition arrives as the art world confronts a more difficult demographic question: how to preserve and place the enormous volume of art likely to be inherited in the coming decade. Nearly $1 trillion worth of art is expected to change hands through the Great Wealth Transfer. Not all of it will find a willing collector or a museum capable of displaying it. Some works may be stored, neglected, or lost altogether, making stewardship as urgent a cultural concern as valuation.

RansomHub threatens leak of 500,000 Christie's records as auction house confirms network intrusion. RansomHub has listed Christie's on its dark web portal, claiming theft of sensitive data for half a million global clients. The auction house admits to a breach but denies financial data loss. Executive takeaway - TL;DR. * Category: - Threat Intelligence * Severity: - Critical * Actor Type: - Ransomware Group * Geography: - Global * Confidence: - High Confidence * CVE: - CVE-2024-24919 * Source: - Mandiant Advantage * Read Time: - 5 min Executive summary. In a significant escalation of cyber-extortion activities within the luxury art sector, the RansomHub cybercriminal syndicate has issued a final ultimatum to Christie's auction house. Following a disruptive 'technology security incident' in mid-May that coincided with major spring auctions in New York, RansomHub has officially added Christie's to its extortion portal. The group asserts it has exfiltrated sensitive personal information belonging to approximately 500,000 high-net-worth clients from around the globe. While Christie's leadership has acknowledged unauthorized access to specific segments of their network, they maintain that there is currently no evidence that financial or transactional records were compromised. This incident underscores the shifting focus of Ransomware-as-a-Service (RaaS) groups toward high-value targets where privacy is a premium commodity. Threat analysis. RansomHub is a sophisticated, relatively new player in the RaaS landscape, first appearing in early 2024. The group has quickly established a reputation for aggressive double-extortion tactics, which involve both the encryption of local systems and the exfiltration of data to a public leak site. Their targeting of Christie's represents a tactical shift toward 'data-only' extortion in scenarios where system encryption might be successfully mitigated by backups, but the threat of public exposure remains a potent lever. By targeting an institution that manages the identities of the world's most affluent individuals, RansomHub is leveraging reputational damage and potential regulatory penalties under the General Data Protection Regulation (GDPR) to compel payment. Technical details. Intelligence gathered from recent incident response engagements suggests that RansomHub affiliates often gain initial access through a combination of credential stuffing and the exploitation of edge-device vulnerabilities. Specifically, investigators are looking for links between this breach and recently disclosed zero-day vulnerabilities in remote access solutions, such as the Check Point VPN information disclosure flaw (CVE-2024-24919), which has been actively exploited by various ransomware affiliates for lateral movement and Active Directory harvesting. Once persistence was established within Christie's network, the actors moved laterally to identify and exfiltrate approximately 500 gigabytes of data. This dataset allegedly includes full names, birth dates, nationalities, and passport or identity document numbers. RansomHub has provided 'proof of life' for the data by publishing screenshots showing database schemas and specific client entries. The group has set a countdown timer on their leak site, threatening to release the full dataset by May 31 if their undisclosed ransom demands are not met. Attribution assessment. Cybersecurity researchers at Mandiant and Unit 42 assess with moderate to high confidence that RansomHub is either a rebranding of the Knight ransomware operation or a coalition of experienced affiliates formerly associated with the ALPHV/BlackCat and LockBit syndicates. The group's infrastructure and malware code show significant similarities to previous Russian-linked operations. RansomHub's business model is notably affiliate-friendly, offering a 90% commission to those who conduct the intrusions, which has allowed them to attract high-tier talent capable of breaching well-defended networks like those found in the global art market. Implications. The implications for Christie's and the broader art market are severe. For Christie's, the breach poses a dual threat of massive regulatory fines and a systemic loss of client trust. The exposure of high-net-worth individuals' data can lead to secondary attacks, including targeted phishing, physical security risks, and identity theft. Furthermore, the timing of the attack - during one of the most critical sales windows of the year - demonstrates that ransomware groups are increasingly timing their activities to maximize operational pressure and financial leverage. Recommendations. To defend against RansomHub and similar RaaS threats, organizations should implement the following measures: * Phishing-Resistant MFA: Deploy hardware-based multi-factor authentication across all external access points and administrative portals. * Vulnerability Management: Prioritize the immediate patching of edge devices, specifically focusing on VPN and firewall vulnerabilities used for initial access. * Data Loss Prevention (DLP): Implement aggressive DLP rules to monitor and block the unauthorized mass exfiltration of sensitive datasets to known cloud storage providers. * Credential Rotation: Enforce mandatory password resets and certificate rotations following the detection of any suspicious lateral movement within the network. * Legal & Regulatory Readiness: Ensure that incident response plans include specific protocols for notifying international privacy regulators (e.g., UK ICO, EU DPA) within the mandatory 72-hour window following a confirmed breach. Need zero click spyware for android and ios? Encrygma delivers serverless, offline, quantum-safe encrypted communications built for executives, agencies, and operators facing zero-click spyware and advanced mobile surveillance threats.