In a letter emailed to clients today, Art Basel leaders said that its parent company MCH Group was hit with “a criminal cyber-attack” last week through the use of malware.

Fair organizers said that the company’s IT specialists immediately took measures to protect its digital infrastructure and restore its systems.

The emailed letter arrived after Artnet News sent an inquiry to Art Basel on Friday October 29, flagging reports in German media and another in English on news site timeshub.com. Neither MCH Group nor Art Basel responded to our questions about whether the breach affected exhibitors, VIP members or all of its clients, or whether the cyber-attack was unique to certain fairs or geographic regions.

MCH Group’s events include the Baselworld watch fair and the Art Basel fairs in Basel, Hong Kong, and Miami.

According to the Times Hub, MCH released  a statement Wednesday evening recommending that users of its online platforms change their passwords and MCH Group access data immediately, as well as the same passwords used for other accounts.

MCH said in the letter that it is working closely with security and cybercrime specialists, including the Swiss National Cyber Security Centre, the police, and external experts. “The most important internal and external communication channels have now been secured and we continue to work to restore all our systems and services as soon as possible,” the organization added.

Early information suggests that the perpetrators may have gained access to data such as personal contact details, MCH said, adding: “We do not yet know the extent of the data breach and these traces are being analyzed in cooperation with cybersecurity experts as a matter of urgency.”

A criminal complaint has been filed against the unknown perpetrators, MCH added.

MCH promised to keep clients updated on “any relevant developments as they become available, including when you will be able to update your Art Basel access credentials on our site and within our Art Basel app.”