Hacker snoops on art sale and walks away with $3.1m, victims fight each other in court

Each impacted party is claiming the other is responsible for not detecting the scam. The ownership of a valuable painting is at stake.

Hackers intercepted talks between an art dealer and a Dutch museum to scam the museum out of millions, and while they walked away with their ill-begotten proceeds, the victims are now fighting over who is responsible. 

As reported by Bloomberg, London-based veteran art dealer Simon Dickinson and Rijksmuseum Twenthe were in the midst of negotiations over the acquisition of a valuable painting by John Constable, a 1700 - 1800's landscape painter from England. 

TechRepublic: How organizations should handle data breaches

In particular, it has been reported that the 1855 painting, "A View of Hampstead Heath: Childs Hill, Harrow in the Distance," caught the eye of the museum's director after they visited a European art fair in 2018.

Conversations took place over email for months, and at some point during the talks, cybercriminals sent spoofed messages to the museum and persuaded Rijksmuseum Twenthe to transfer £2.4 million ($3.1 million) into a bank account from Hong Kong. 

As a result, the art dealer was never paid for the painting. It is not known who is responsible for the theft. 

CNET: FTC warns phone companies not to help robocallers

In the aftermath of the scam, both Simon Dickinson and Rijksmuseum Twenthe are claiming the other side is responsible. 

A lawsuit has been launched at a London High Court. The museum, based in Enschede, the Netherlands, claims that the art dealer's negotiators were roped into some of the spoof emails, and yet did not spot the scam.   

The museum's lawyer has argued that this silence should be considered "implied representation," according to the publication. 

In response, Simon Dickinson says that the dealer did not detect the presence of the eavesdropper and the museum should have double-checked the bank details before transferring any cash. 

Each side is also accusing the other of being the source of the theft by allowing their systems to be compromised in the first place.

Rijksmuseum Twenthe is seeking damages. On Thursday, the court threw out initial claims that the dealer was negligent -- but said that amended claims for damages may be considered. 

See also: Practice Fusion to pay $145m for accepting pharma kickbacks in opioid prescription scam

In the meantime, the museum is holding on to the painting, Bloomberg says, despite Simon Dickinson being unpaid -- and is also preventing the dealer from selling the artwork on to any other collector. According to Artnet, the judge must now decide on who owns the painting. 

Neither Rijksmuseum Twenthe or Dickinson have commented on the case. 

Previous and related coverage

• Facebook agrees to pay $550 million to end facial recognition tech lawsuit
• Avast winds down Jumpshot, cites user data sale privacy concerns
• Ring app for Android full to the brim with third-party trackers: report

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0