Cyber Incident Victim: Ronin Gallery
Date:
Dec 2017
Location:
United States of America
Summary
A New York-based art gallery experienced a payment card breach involving unauthorized code inserted into its website, compromising customer names, contact details, and full payment card information including CVV codes. The breach persisted for over seven months before detection, with the gallery's web provider alerting them to the incident approximately two months after the malicious activity concluded. The entity did not disclose its provider's identity or clarify responsibility for security failures leading to the prolonged undetected compromise.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Ronin Gallery, a New York-based art dealer specializing in Japanese and Eastern Asian artworks, experienced a payment card breach affecting its online customers. According to their notification, the gallery's website provider alerted them on October 18, 2018, about unauthorized code inserted into their payment system. This malicious code operated undetected for nearly eight months, capturing customers' personal and financial information during online transactions between December 29, 2017, and August 16, 2018. Compromised data included full names, postal addresses, email addresses, telephone numbers, payment card numbers, card expiration dates, and CVV security codes. The breach timeline indicates attackers maintained persistent access to the gallery's e-commerce environment throughout this period, though the exact intrusion method remains undisclosed. No evidence suggests physical gallery transactions or non-web payment channels were affected.
In response to the provider's discovery, Ronin Gallery initiated customer notifications in December 2018, approximately two months after being alerted to the compromise. Their public breach disclosure did not identify the website provider or specify whether third-party security failures contributed to the incident. The notification omitted technical details about how the malicious code operated or why detection required third-party intervention. Affected customers were advised to monitor their payment card statements for unauthorized transactions but received no offer of credit monitoring services. The gallery's delayed public acknowledgment—coming nearly four months after the breach window closed—left customers exposed to potential fraud for an extended period without warning. The incident impacted all customers who made online purchases through the gallery's website during the 7.5-month exposure period.