Artvalue.com Exposes 158,692 User Accounts in Public Text File
What Happened — In June 2019 the French art‑valuation site Artvalue.com unintentionally published a plain‑text file on its public web server. The file listed 157,692 subscriber records – names, usernames, email addresses and passwords stored as unsalted MD5 hashes. The file was later removed after being reported, but the data had already been harvested.
Why It Matters for Trust & Control Assurance
- It is a classic example of a public‑facing asset lacking continuous monitoring – a control‑area that a continuous assurance program is built to detect and document.
- Storing passwords as raw MD5 hashes violates strong‑authentication controls and creates a gap in audit evidence for credential protection.
- The incident highlights the need for systematic vendor‑risk oversight: even niche services must be vetted for data‑handling and asset‑inventory controls before integration.
Who Is Affected – Art and valuation firms, collectors, and any individuals who subscribed to Artvalue.com (professional‑services sector).
Recommended Actions –
- Perform an inventory‑and‑monitoring sweep of all public‑facing repositories to ensure no unintended data is exposed.
- Upgrade password storage to salted, computationally‑hard hashing (e.g., bcrypt, Argon2) and document the policy for audit readiness.
- Incorporate evidence of asset‑inventory and monitoring into your continuous control‑assurance program or Trust Center.
Technical Notes – Exposure vector: misconfigured public file on web server. No known exploitation beyond data harvest. Passwords were stored as MD5 hashes, which are cryptographically weak. Source: Have I Been Pwned – Artvalue breach