The threat actor claims that ArtNexus's Firebase Realtime Database was exposed without authentication, allegedly allowing full read access to the platform's operational data. The exposed information reportedly includes collector, gallery, and curator emails, Firebase user accounts, purchase and payment records, checkout information containing addresses and phone numbers, Stripe Source tokens, and buyer-seller negotiation messages.