A threat actor claims to have breached Robert Finale Editions, stealing and publishing a database and extensive website files associated with the art publisher’s WordPress installation.
The alleged breach was disclosed on Aug. 31, with the actor claiming the intrusion occurred sometime in August 2026. While the original post described the compromised material simply as the company’s WordPress database and source code, a file tree provided alongside the leak indicates the archive may contain a considerably broader copy of the website environment.
The tree lists WordPress configuration and application files, plugins, themes, uploaded media, server logs and multiple database backups. BreachNews has not independently verified that the files originated from Robert Finale Editions or established how the actor allegedly obtained them.
File tree shows database backups and WordPress installation
The leaked file tree appears to contain a substantial WordPress installation rather than a limited collection of website source files.
Among the material listed is a top-level SQL database backup as well as multiple compressed SQL backups stored within the WordPress content directories. The tree also contains WordPress configuration files and the standard administrative and application components of a WordPress installation.
Other directories indicate the archive includes:
- WordPress core files
- Website configuration files
- Multiple SQL database backups
- Installed plugins and themes
- Uploaded website media
- WooCommerce components
- Cache and optimization data
- Server and application error logs
The presence of these files provides additional support for the actor’s claim that a substantial portion of the website environment was obtained. It does not, however, independently establish how the files were acquired or when they were extracted.
WooCommerce components appear in leaked archive
The file listing also shows WooCommerce components and several other plugins associated with the WordPress environment.
That finding does not establish that payment information, customer records or order histories were compromised. Determining what personal information was exposed would require examining the contents of the alleged database, rather than relying on filenames and directory structures alone.
The actor did not disclose a database record count or provide a detailed breakdown of any user or customer information allegedly contained in the SQL files.
BreachNews is therefore not attributing any specific customer-data exposure to the incident based solely on the available file tree.
Archive could expose website configuration
If authentic, the apparent scope of the archive could create risks beyond the database itself.
A complete WordPress environment can contain information about installed plugins, themes, custom functionality and server configuration. Configuration and backup files may also contain sensitive operational information depending on how the website was configured at the time the files were created.
The tree indicates that WordPress configuration files were included in the archive, but BreachNews has not reviewed or published their contents and is not disclosing potentially sensitive configuration information.
The listing also contains multiple database backups, suggesting the alleged compromise may include historical copies of the site’s database in addition to the primary database dump.
Robert Finale Editions operates online art catalog
Robert Finale Editions operates the official website and catalog for contemporary romantic impressionist artist Robert Finale.
The website showcases Finale’s artwork and maintains information about galleries and dealers carrying his work. Public pages identify Robert Finale Editions as the company responsible for the artist’s editions and catalog.
The company has also been active in protecting its intellectual property. In June 2026, Robert Finale Editions filed a federal copyright infringement lawsuit in the Western District of Pennsylvania concerning alleged unauthorized use of its artwork.
That litigation is unrelated to the newly alleged cyber incident.
Claim remains unconfirmed
The additional file tree gives the breach claim more substance than the actor’s original short forum post, particularly because it describes a coherent WordPress environment containing database backups, website assets and application components.
However, a directory listing alone cannot prove that the material was obtained through a recent breach of Robert Finale Editions. BreachNews has not independently authenticated the database or established whether the files contain current customer information.
Robert Finale Editions had not issued any public statement regarding the alleged August breach at time of publication.
