Hacking art galleries and earning $3M USD by selling paintings. Are they hackers or artists?

Artworks have always been the subject of the desire of thieves, and great crimes have occurred in the most important museums in the world, or at least that was the case before technology occupied virtually any aspect of our lives. Cybersecurity specialists claim that hackers are exploring new attack vectors capable of compromising unusual terrain.

A report indicates that the buyer of a recognized artwork was tricked by threat actors into sending payment for the work (more than $2.5 million USD) to the wrong bank account, operated by hackers. The painting in question is “A View of Hampstead Heath: Child’s Hill”, by British artist John Constable, a major representative of the romantic artistic period in the United Kingdom. 

Those involved are Simon Dickinson, a London-based art dealer, and the administration of the Dutch museum Rijksmuseum Twenthe. During the Maastricht Fine Arts Fair, both parties agreed to buy and sell the work, agreeing to fix all the details via email. Through the exchange of messages both parties began to negotiate a price.

However, those involved did not count on a hacker from getting in the way of the process, tricking the buyer into sending the money to an account at a Hong Kong bank. The museum completed the bank transfer without realizing that the money was sent to a hacker.

Those involved are in a legal dispute due to this incident. The administration of the Enschede museum, the current owner of the painting in question, confirmed the crime, although director Arnould Odding concluded his message by saying that for the time being he cannot comment further.

According to a British news agency, both involved deny that the attack occurred due to some security flaw in their respective systems. The art dealer’s defense alleges that the Dutch museum should have independently confirmed the bank account data to the traders, while Rijksmuseum Twenthe argues that British museum staff paid little attention to the minimal cybersecurity measures recommended by European authorities.

During the first hearings on this case, Bobby Friedman, legal representative of the British art dealer, assured the High Court that the Dutch museum should not keep the painting, as the sellers received no payment. This painting is one of several works created in the nineteenth century by Constable, known for painting the entire area surrounding his home in Suffolk, now known as ‘Constable Country’.

The legal dispute continues as the authorities try to track the transaction, although in advance they let those involved know that this process has little chance of being successful.