Gagosian listed on daixin ransomware leak site

• Ransomware group: daixin
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: September 11, 2025

Gagosian listed on daixin ransomware leak site

The global art gallery Gagosian has been listed on the leak site of the daixin ransomware group. According to the announcement made by the group, they claim to have obtained access to data belonging to the organization.

Details of the claim

The daixin group listed Gagosian on its leak site on September 11, 2025. The group claims to have successfully accessed the organization's internal data. At this time, public information regarding the specific operations and background of the daixin group remains limited.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public gallery of successful breaches, where attackers post names of organizations to increase visibility and reputational pressure. When a group claims access to data, it often follows a pattern of initial intrusion followed by data exfiltration, a tactic frequently used to maximize leverage over the target.

Information regarding the leaked data

Regarding the specific nature of the information involved in this incident, no information or screenshots regarding the nature of the leaked data have been provided by the threat actors.

Data status

• No specific data types have been identified in the listing.

In many modern ransomware scenarios, attackers employ a method known as double extortion. In this method, the threat actor not only encrypts the victim's systems to disrupt operations but also steals sensitive information to threaten its public release. This dual approach increases the pressure on an organization, as they face both operational downtime and the potential for massive reputational damage and legal consequences if their proprietary or client information is leaked.

About Gagosian

Gagosian is a global gallery specializing in modern and contemporary art, established by Larry Gagosian in 1980. With eighteen exhibition spaces across the United States, Europe, and Asia, the institution employs more than three hundred people.

Potential risks and implications

This situation may create secondary risks such as identity theft or targeted phishing attacks for the organization's employees and customers. As a US-based entity, any potential data breach may be subject to state-level data protection laws and regulations. Disruptions in the organization's operational processes may be observed, which could lead to reputational damage. If a double extortion method is employed, increased pressure on the organization may be expected.

For organizations operating in the retail and e-commerce sectors, such as high-end art galleries, maintaining robust cybersecurity postures is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all access points, maintaining regular offline backups of critical data, and conducting regular employee training to recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring strict network segmentation can help limit the lateral movement of attackers within a network. As regulatory landscapes evolve, adhering to regional data protection standards is essential for mitigating the legal risks associated with potential data exposure.