The Los Angeles County Museum of Art (LACMA) is notifying customers and employees that a cyberattack last year exposed sensitive personal information, including Social Security numbers and medical data. The museum detected suspicious activity on July 11, 2025 — tracing the intrusion back four days to July 7. A month later, investigators confirmed a network compromise, but identifying exactly what data was accessed took until late February 2026. LACMA is now sending personalized breach notifications to everyone whose information was involved.
The exposed data includes Social Security numbers and medical information alongside other personal and financial details typically collected from museum members, donors, and staff. No attacker has been publicly identified, and LACMA has not disclosed how many individuals are affected. Law enforcement has been notified. Impacted individuals are being offered a one-year identity theft and fraud protection service through Financial Shield, with an enrollment deadline of November 22, 2026. A dedicated support line has been set up to answer questions from affected parties.
How to check if you’re affected
Affected products and services include anything tied to LACMA membership, employment, or donor records from 2025 or earlier. If you are or were a LACMA member, employee, or donor, watch for a breach notification letter in the mail — it will include enrollment instructions for the free identity protection service. As a precaution, place a free credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion), monitor your bank and health insurance accounts for unfamiliar activity, and report any suspected identity theft to the FTC at IdentityTheft.gov.