Every Monday morning, Artnet News brings you The Gray Market. The column decodes important stories from the previous week—and offers unparalleled insight into the inner workings of the art industry in the process.

This week, a reinforcement of the maxim that only the paranoid survive…

ONCE MORE INTO THE BREACH

Last Sunday, Reuters broke the news of what appears to be one of the most expansive, longest-running, and most damaging hacks in US history. The story should also double as a visceral reminder that, as the art market continues its aggressive march into enhanced online sales and global connectivity, cybersecurity deserves far more attention than it’s likely gotten during this anarchic year.

First uncovered by the cybersecurity firm FireEye, the mega-breach qualifies as what experts call a “supply-chain attack.” Rather than directly infiltrating their targets by stealing employees’ usernames and passwords, hackers instead broke into software that the true targets installed from a legitimate third-party supplier as part of a regular systems update. The corrupt software then provided the assailants a difficult-to-detect back door into the end user’s network—a back door that has been swinging open for six to nine months, per multiple reports.

Central to the debacle is a Texas-based IT company called SolarWinds, which produces software that manages the server networks of major public and private clients alike. According to Reuters, the firm’s “customers include most of America’s Fortune 500 companies, the top 10 US telecommunications providers, all five branches of the US military, the State Department, the National Security Agency, and the Office of President of the United States.” 

While the full extent of the SolarWinds breach will not be known for months, Microsoft confirmed that the hackers exploited at least “40 companies, government agencies, and think tanks,” per the New York Times. “Nearly half” of that cohort’s members are private tech companies, with “many” specializing in cybersecurity. An earlier Times story identified the Department of Homeland Security and “parts of the Pentagon” as confirmed government…