LACMA Reports Data Breach Exposing Sensitive Customer and Employee Information

The Los Angeles County Museum of Art (LACMA) has announced that a data breach last year exposed sensitive information belonging to both customers and employees. The museum detected suspicious activity on its systems on July 11, 2025, which had begun four days earlier. Following an investigation that confirmed the network was compromised, LACMA was able to identify the nature of the exposed data more than a year later, in late February 2026.

The museum has reported that the breach may have allowed unauthorized access to personal information, including social security and medical data. In response to the incident, LACMA has notified law enforcement authorities and sent personalized notifications to those affected by the breach. The notifications recommend that recipients monitor their bank accounts for any unusual activity, consider placing a security freeze or fraud alert on their credit files, and report any identity theft attempts to their financial institutions and law enforcement.

As part of its response, LACMA is offering impacted individuals a one-year enrollment in an identity theft and fraud protection service through Financial Shield, with a deadline for enrollment set for November 22. Additionally, the museum has established a dedicated phone line to provide support and answer questions for those affected.

LACMA is recognized as one of the largest art museums in the western United States, housing approximately 155,000 works that span 6,000 years of art history. The museum typically attracts over one million visitors annually. BleepingComputer has reached out to LACMA for further details regarding the number of individuals impacted and the specifics of the attack, but has not received a response as of the time of publication. The incident highlights ongoing concerns about data security and the vulnerabilities that institutions face in protecting sensitive information.