LACMA Data Breach: Social Security Numbers and Medical Information at Risk

The Los Angeles County Museum of Art (LACMA) is one of the largest art museums in the western United States, home to some 155,000 works spanning six thousand years of art history. Now, against its will, its holdings have been joined by one more collection — of stolen personal data.

A timeline that stretched out over a year

The museum first noticed suspicious activity in its systems on July 11, 2025, though the intrusion had actually begun four days earlier. A month later, the investigation confirmed that the network had been compromised, but which data had been affected could not be determined at the time. The first findings did not emerge until late February 2026, and the museum was only able to name the full list of leaked information more than a year after the incident was discovered.

What may have fallen into the attackers' hands

The list proved to be a long one. According to the museum, the attackers may have gained access to full names, dates of birth, Social Security numbers, driver's license and state ID numbers, partial bank account and payment card details, as well as health insurance information. Especially alarming is the exposure of medical information proper: the names of treatment facilities, treatment records, diagnoses, and the dates and places where care was provided.

LACMA notified law enforcement and sent individual notices to those affected. They are advised to monitor their bank accounts, consider placing a freeze on their credit history or setting up a fraud alert, and to report any attempts at identity theft. In addition, the museum is offering a one-year subscription to the Financial Shield fraud-protection service — enrollment is open until November 22. A dedicated support hotline has also been set up for those affected.

Key details remain unknown: the museum has not disclosed exactly how many people were affected or how the breach was carried out. LACMA had not responded to questions from BleepingComputer by the time of publication.

The incident is yet another reminder that the targets of cyberattacks have long since ceased to be confined to the financial sector and the tech giants. Cultural institutions, accustomed to safeguarding paintings and sculptures, turn out to be just as vulnerable when it comes to the digital archives of their visitors and staff.

Source: Bleeping Computer