Hackers posing as an art dealer convinced a Dutch museum to pay them $3.1 million.

Hackers conned a Dutch museum out of $3.1 million dollars by posing as a London art dealer. In the midst of negotiations between the Netherlands-based museum Rijksmuseum Twenthe and London- and New York-based Old Masters gallery Dickinson, cyber criminals intercepted the two parties’ communications and convinced the museum to put £2.4 million ($3.1 million) into a fraudulent account. The museum and art dealer are now in court, with each side claiming the other got hacked.

Arnoud Odding, the director of Rijksmuseum Twenthe, hoped to purchase a John Constable painting he first saw at the European Fine Art Fair in 2018. The hackers were able to intercept email communications—it’s unclear whether they infiltrated the museum’s or dealer’s account—and send a number of emails seeming to come from Dickinson, including one with instructions to deposit payment into a Hong Kong account.

In a conversation with the Dutch broadcast agency NOS, and reported by the NL Times, Odding said:

Investigations have shown that our email systems had no vulnerabilities, that they were up-to-date and in order. We ultimately took the art dealer to court to make it clear that this painting was bought and paid for.

The museum’s lawyer argued that the negotiators for the art dealer were included on several of these spoof emails, and that they should have alerted the museum to the fraud. Dickinson’s lawyer argues that the museum should have verified the bank details for the Hong Kong account independently before sending payment. On Thursday, a judge ruled against the museum in a claim for damages, though the judge added the museum can amend the claims if they’d like to try to proceed with the case.

According to Bloomberg, in court documents, the lawyer for Dickinson argued: “Instead of accepting the reality of the situation, the museum has reacted by pursuing a series of hopeless claims against [Dickinson], in the hope of pinning the blame for the museum’s mistake on [Dickinson].”

Rijksmuseum Twenthe is currently in possession of the painting and will not return it, even though Dickinson never received payment for the work.

Further Reading: How Forgers and Grifters Have Conned the Art World for Generations