LACMA Says 2025 Breach Exposed Personal, Financial and Medical Information
The Los Angeles County Museum of Art (LACMA) has notified individuals that a cyberattack discovered in 2025 may have exposed sensitive personal, financial and medical information belonging to some cus...
The Los Angeles County Museum of Art (LACMA) has notified individuals that a cyberattack discovered in 2025 may have exposed sensitive personal, financial and medical information belonging to some customers and employees.
According to the museum, suspicious activity was identified on July 11, 2025, after unauthorized activity had reportedly been present on its systems for several days. LACMA determined approximately one month later that its network had been compromised. Investigators initially could not establish what information had been accessed, and the museum says it obtained additional findings in late February 2026.
The museum has now identified several categories of information that may have been available to the attacker. These include:
- Names and dates of birth
- Social Security numbers
- Driver’s license or other government identification numbers
- Partial financial account and payment card details
- Health insurance information
- Medical details, including healthcare providers, diagnoses, treatments, treatment dates and treatment locations
LACMA said it reported the incident to law enforcement and is sending individualized breach notifications to affected people. The organization has also established a dedicated telephone line for questions and support.
Recipients are being advised to review bank and payment account activity, remain alert for attempted identity theft and notify financial institutions or law enforcement about suspicious activity. They may also consider placing a fraud alert or security freeze with the major credit-reporting agencies.
The notification letters offer one year of identity-theft and fraud-monitoring services through Financial Shield. Eligible individuals must enroll by November 22, although the museum’s notice should be consulted for the applicable year and enrollment instructions.
LACMA has not publicly disclosed how many people were affected or explained how the attackers gained access. The museum is among the largest art institutions in the western United States, with roughly 155,000 works in its collection and historically more than one million visitors each year.
