Luxury real estate firm New Zealand Sotheby’s International Realty is investigating a cyber security incident involving unauthorised access to data held within a third-party software platform.
The affected third-party software was a Customer Relationship Management (CRM) system containing limited contact information for marketing and operational purposes.
In a statement, Sotheby’s said data which may have been accessed in the incident included names, addresses, phone numbers and email addresses.
“No email exchanges, documentation or other substantive material relating to properties have been accessed,” the statement read.
“The platform is not used to store information used for customer financial transactions.”
The firm said it “took immediate steps to contain the incident” and had engaged independent cyber security specialists to investigate.
“As standard operating procedure, NZSIR already regularly reviews its security controls and constantly adapts to the changing threat landscape. The forensic investigation remains ongoing.”
While the “threat actor” claimed to have obtained 1.6 million contacts from the cyber-attack, Sotheby’s refuted the assertion.
“NZSIR does not have anywhere near that number of contacts on its database. Third-party platform forensic investigators advise that this number relates to duplicate entries.”
Sotheby’s said its client database was informed of the breach on Monday.
“We recognise the trust our clients place in us and regret any concern this incident may cause,” NZSIR managing director Mark Harris said.
“Since becoming aware of the incident, our focus has been on containing the issue, understanding exactly what occurred, and working with independent cyber security specialists to protect client information. We remain committed to transparency and will continue to provide updates as deemed necessary.”
The National Cyber Security Centre and the Office of the Privacy Commissioner was notified as a precaution.