The Los Angeles County Museum of Art (LACMA) has confirmed that a data breach last year exposed sensitive personal and medical information belonging to its customers and employees. The museum detected suspicious activity on its systems on July 11, 2025, which investigators later determined had begun four days prior.
A month after the initial detection, the museum's investigation confirmed that its network had been compromised. However, the specific types of data accessed by the attacker could not be immediately determined. The initial findings from the investigation became available in late February 2026, more than seven months after the breach was discovered.
Over a year after the incident began, LACMA identified that the compromised data may include full names, dates of birth, Social Security numbers, and driver's license or other government-issued identification numbers. Additionally, partial financial account numbers and partial payment card information were potentially exposed.
For some individuals, the breach also included health insurance information and medical details such as provider names, medical treatments, diagnoses, treatment dates, or treatment locations.
LACMA has reported the incident to law enforcement authorities and has begun sending personalized data breach notifications to affected individuals. These notifications advise recipients to monitor their bank accounts for unusual activity, consider placing a security freeze or fraud alert on their credit files, and report any attempts at identity theft to their financial institutions and law enforcement.
The museum is offering a one-year identity theft and fraud protection service through Financial Shield to impacted individuals, with an enrollment deadline of November 22. A dedicated phone line has also been established to provide support and answer questions for those affected by the breach.
LACMA, one of the largest art museums in the western United States, houses approximately 155,000 works of art spanning 6,000 years and typically attracts over a million visitors annually. The museum has not publicly disclosed the number of individuals impacted by the breach or the specific nature of the attack.
