The Rijksmuseum Twente in Enschedé has been bamboozled out of almost €3m by cyber criminals during a transaction to buy a work of art.

Director Arnoud Odding confirmed the story to broadcaster NOS but declined to give a full comment because the work in question, A View of Hampstead Heath: Child’s Hill, Harrow in the Distance by John Constable, is subject of a court case.

According to Bloomberg, Odding spotted the Constable at the Tefaf art fair in Maastricht where it was exhibited by London art dealer Simon Dickinson. The two entered into negotiations via email and an amount of €2.85m was agreed on.

Unbeknownst to the parties, hackers managed to take over the negotiations by inserting their own e-mails into the exchange, including one containing an account number in Hong Kong to which the money was duly transferred.

According to the museum’s lawyer, the negotiators acting for Dickinson never corrected the impression the e-mails came from them while lawyers for the dealer said the museum should have checked the account number was genuine and linked to the right party. Both the museum and the art dealer are saying their internet safety systems are up to date.

Dickinson’s claim was vindicated in court with the judge dismissing the museum’s assertion that the dealer ‘owed a duty of care to maintain reasonable email cybersecurity’ but leaving open a possibility for the museum to file an alternative claim, Bloomberg said.

Odding told NOS that despite the court’s ruling the painting ‘was bought and paid for’ and that he will be pursuing the case in court. He did not specify on which grounds.

The painting is currently at the museum in Enschedé despite the fact that Dickinson, and the painting’s undisclosed owner, never received the money for it.

‘We are doing things like fundraising and we need the painting to do this. And we want experts to have another look at it and know exactly what you are dealing with,’ Odding told the broadcaster.