Artsy Data Breach (2018): What Was Exposed & What To Do

People whose accounts were created on Artsy before April 2018 may find their email addresses, names, IP addresses and password hashes circulating on underground forums. The incident was reported on 1 April 2018 and is stated to have affected 1.1 million accounts. Because the data later appeared for sale on a dark-web marketplace, anyone who used the same password elsewhere faces a straightforward risk of credential stuffing. The practical consequence is that email addresses paired with salted SHA-512 password hashes can be tested against other services without the original plaintext ever being recovered on the Artsy side. IP addresses recorded at the time of account activity add a further layer of linkage that could be used to correlate activity across sites.

Breaking down the breach

Public reporting on the incident is limited to the date it became known and the claim that more than one million records were offered for sale. No information has been released about when the data were first obtained, how access was gained, or whether the intrusion was noticed internally before the marketplace listing. The only confirmed detail is that the exposed records contained email addresses, names, IP addresses and passwords stored as salted SHA-512 hashes.

How a breach like this happens

Incidents involving online platforms commonly begin with the compromise of a web application or its supporting infrastructure. Once an attacker obtains a copy of the user database, the records can be packaged and listed on forums that specialise in the trade of stolen credentials. The presence of salted hashes indicates that passwords were not stored in plaintext, yet the hashes themselves remain usable for offline guessing or for testing against other services that accept the same password.

About Artsy

Artsy operates an online platform that connects users with art, artists and galleries. Account creation is required for features such as saving works, following artists and receiving notifications. Organisations of this type routinely store contact details, login credentials and connection metadata to support user accounts and to analyse traffic patterns.

What data was at risk

The marketplace listing is reported to have included four categories of information. Exact confirmation of every field present in the dataset has not been published by the organisation.

• Email addresses
• Names
• IP addresses
• Passwords stored as salted SHA-512 hashes

What's at stake

For individuals, the main exposure is reuse of the same email-and-password combination on other sites. IP addresses recorded at the time of account activity can assist in linking a person to specific online actions. For the organisation, the incident illustrates the long-term value attackers place on even hashed credential sets from platforms that maintain large user bases.

What to do if you're exposed

Change the password on any account that used the same credentials. Enable multi-factor authentication wherever it is offered. Monitor incoming email for unexpected password-reset messages. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.