How the Artsy Database Breach Led to 1 Million Stolen Names and Passwords

HEROIC analysts identified a database breach affecting Artsy, a U.S.-based online arts marketplace and database that connects collectors, galleries, and art enthusiasts worldwide. The breach occured in April 2018 and exposed 1,079,634 user records. The compromised data included email addresses, first and last names, IP addresses, password hashes, and the salt values used to generate those hashes, making this a particularly complete credential dataset that was later listed for sale on dark web marketplaces.

Why Names, IP Addresses, and Salts Make the Artsy Breach Especially Serious

Most breaches expose email addresses and password hashes, but the Artsy breach also leaked first names, last names, IP addresses, and the cryptographic salt values tied to each password. Salt values are pieces of data that make password hashing stronger, but when those salts are exposed alongside the hash, attackers can craft targeted cracking attempts for each account individually. Combined with real names and IP addresses, this gives criminals enough information to beleive they can reliably impersonate victims, build convincing phishing messages, and trace approximate locations.

What Was Exposed in the Artsy Breach

• Email Address
• Password Hash
• First Name
• Last Name
• IP Address
• Salt

Why the Artsy Breach Creates Real Identity Theft Risk

The combination of real names, email addresses, and IP addresses from the Artsy breach gives attackers a foundation for targeted identity theft and financial fraud. Criminals can use this data to craft personalized phishing emails that reference your name and appear trustworthy. If your password was reused on other services, credential stuffing attacks can lead to account takeover on platforms that store payment information, and the damage can spread across seperate accounts and institutions before you are even aware of the compromise.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to the server-side storage system of a platform, often by exploiting a software vulnerability, weak access controls, or an exposed administrative interface. Once inside, the attacker copies or downloads the user database, which contains account credentials and personal details. In the Artsy case, the full database was packaged and offered for sale on a dark web marketplace, where it could be purchased and used by multiple criminal actors over time.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to determine whether your email address appeared in the Artsy breach or any other known data incident. Run a free check now to see exactly what information about you is circulating online and take steps to secure any accounts that may have been compromised.