Several prominent museums have been unable to display their collections online since a cyberattack hit a leading technology services provider that helps hundreds of cultural organizations display their works digitally and manage internal documents.
The Museum of Fine Arts in Boston, the Rubin Museum of Art in New York and the Crystal Bridges Museum of American Art in Arkansas were among the institutions that confirmed their systems had experienced outages in recent days.
The service provider, Gallery Systems, said in a recent message to customers, obtained by The New York Times, that it had noticed a problem on December 28, when computers running its software became encrypted and could no longer function. “We immediately took steps to isolate those systems and implemented measures to prevent additional systems from being affected, including taking the systems offline as a precaution,” the company said in the message. “We also launched an investigation and external cybersecurity experts were brought in to assist. In addition, we notify the authorities.”
Gallery Systems did not immediately respond to email and telephone requests for comment.
Signs of disruption were evident on several museums’ websites because eMuseum, a tool that normally allows visitors to search for collections online, was down. There were also disruptions behind the scenes: Some curators said they had returned from winter break and were unable to access sensitive information from another Gallery Systems program called TMS. That system can include donor names, loan agreements, provenance records, shipping information and storage locations for priceless works of art.
“We realized that the outage began on December 28,” said Sandrine Milet, a spokeswoman for the Rubin Museum. “TMS was back up and running yesterday while eMuseum is still down.”
T. Barton Thurber, director of the Frances Lehman Loeb Art Center at Vassar College, said: “I can confirm that, unfortunately, our museum, along with many others, has been affected by the attack.”
Paige Francis, chief information officer at Crystal Bridges, said: “What concerns us most is the public’s inability to benefit from viewing our collection remotely during this disruption.”
According to some security experts, cyberattacks against cultural groups are increasingly common. In November, a ransomware group stole personal data from the British Library and published images of internal human resources files. The Metropolitan Opera and Philadelphia Orchestra also suffered cyberattacks last winter, hampering their ability to sell tickets online.
In many cases, these attacks come from ransomware groups, which hold the online service hostage until victims pay a sum. The nature of the attack on Gallery Systems was unclear.
Some museums that rely on Gallery Systems, including the Metropolitan Museum of Art and the Whitney Museum of American Art, said they were not affected because they host their own databases.
It was not immediately clear how widespread the cyberattack was or what its full impact would be.
“Museum objects are valuable, but the information about them is really priceless,” said Erin Thompson, a professor of art crime at John Jay College of Criminal Justice in New York. “Often, generations of curators will have worked to research and document an artifact. If this information is lost, the blow to our knowledge of the world would be immense.”
