LACMA Data Breach Exposed Social Security Numbers and Health Information

The Los Angeles County Museum of Art (LACMA) has disclosed a data breach that may have exposed sensitive personal, financial, and health information belonging to customers and employees.

LACMA detected suspicious activity on its network on July 11, 2025. The museum said the unauthorized activity began four days earlier, on July 7. An investigation completed the following month confirmed that attackers had compromised its systems.

At the time, LACMA could not determine what information had been accessed. The museum’s initial findings were not publicly disclosed until late February 2026.

According to LACMA’s data security incident notice, the information potentially accessed by the attacker may include:

• Full name
• Date of birth
• Social Security number
• Driver’s license or government-issued identification number
• Partial financial account number
• Payment card information
• Health insurance information
• Medical information, including healthcare provider names, treatments, diagnoses, treatment dates, and treatment locations

LACMA said it notified law enforcement agencies about the incident and sent individual data breach notification letters to affected people. The museum also filed a data breach notification with California authorities.

Recipients are encouraged to monitor their bank and financial accounts for suspicious activity. They should also consider placing a security freeze or fraud alert on their credit files and report suspected identity theft to their financial institutions and law enforcement agencies.

The notification letter includes instructions for enrolling in one year of identity theft protection and fraud prevention services through Financial Shield. The registration deadline is November 22.

LACMA has also established a dedicated telephone hotline to answer questions and provide assistance to individuals affected by the breach.

The Los Angeles County Museum of Art is one of the largest art museums in the Western United States. Its collection contains approximately 155,000 works spanning 6,000 years of art history, and the museum has historically welcomed more than 1 million visitors each year.

BleepingComputer contacted LACMA to ask how many individuals were affected and for additional details about the cyberattack. The museum had not responded by press time.

Prevention scores do not always show what happens after an attacker gains initial access. When cybercriminals use valid credentials, an organization’s defenses can weaken significantly.

Blue Report 2026 measures defensive techniques across technologies using 338 million simulations conducted in customer production environments.

Get the report