By Greg Smith

UNITED STATES – The auction software company SimpleAuctionSite was the target of a ransomware attack late in the evening on December 17, resulting in delayed and suspended sales among the company’s 150 auction house clients.

The company’s owner, Bob Freedman, said a message appeared on the company’s server around 11:30 pm that night. By that time, the criminals had already encrypted his servers and deleted backup systems. They began demanding separate payments in the form of Bitcoin for each of the company’s 13 servers. Freedman said the total figure paid was “well into the six figures.” The company was insured against the attack.

Shortly after his servers were taken over, Freedman hired the cyber security company Spear Tip to negotiate their return. The security company said they believed the hackers were Russian and they used a virus called “Waiting.”

“From the outset, the process was getting up and operational first, and then to protect ourselves with new software to prevent this from happening again,” Freedman said.

Though there is no relief in falling victim to a coordinated attack, the holiday weekend was among the lighter times in the auction industry’s sale schedule.

SimpleAuctionSite’s auction house partners, who utilize its software for all functions of their business – consignments, cataloging, invoicing, running an auction, etc. – were down for a total of nine days following the attack.

Freedman said he had three or four companies with auctions ending the night of the attack and others that had sales scheduled to close during the downtime. All were postponed.

“We don’t believe there was data stolen, but the forensic analysis will have to prove that out,” Freedman said, noting that once everything is fully operational, he plans to have an audit performed.

SimpleAuctionSite is the second auction-related technology company that has been targeted in recent months. LiveAuctioneers was hacked in July, with the data from its 3.4 million users spilled onto the web and sold to anyone willing to pay.

SimpleAuctionSite was purchased in 2017 by Barnebys, a Sweden-based digital marketplace for art sales and auction advertising. Freedman said he has no reason to believe the hack extended to the digital parent company.