August 25–26, 2026: The Los Angeles County Museum of Art (LACMA) publicly confirmed a July 2025 network intrusion exposing employee and visitor PII — including Social Security numbers, driver’s licenses, and limited health-insurance/medical fields. Former assistant film curator Adam Piron filed a class-action lawsuit alleging delayed notice left victims unable to protect themselves. Canonical: lacma-network2025. Sources: ARTnews, BleepingComputer, MyNewsLA.
Museums hold donor rolls, member addresses, and employee HR files — not just gift-shop emails. When SSNs and medical fields appear in a cultural-institution breach, the victim pool spans curators, contractors, and the million-plus annual visitors LACMA cites in court papers.
What happened: LACMA data breach timeline
LACMA detected suspicious activity on July 11, 2025. Forensics found unauthorized access to a portion of its network from July 7–11, 2025. A data-review vendor identified varying exposure per person. Public website notice and reporting intensified in August 2026 — roughly a year after the intrusion window.
What data was exposed?
LACMA’s notice and the complaint describe possible fields including:
- Names, addresses, dates of birth
- Social Security numbers
- Driver’s license / government ID numbers
- Health insurance information and limited medical fields (provider, treatment, diagnosis, dates/locations)
- Limited financial/payment-card numbers for some individuals
Categories varied by person; not every field applies to every victim.
The class-action angle
Piron, a former employee (2018–2020), sued in California Superior Court on behalf of affected individuals. The complaint alleges negligent safeguarding and seeks damages plus court-ordered security improvements. ARTnews reports Piron learned of the breach in June 2026 — before the museum’s Monday public statement — and argues the delay prevented timely credit freezes and fraud monitoring.
Who is at risk?
Current and former LACMA employees, members/donors, visitors whose data sat in compromised systems, and vendors with HR or ticketing integrations. Anyone with SSN exposure should assume lifelong elevated phishing risk.
What LACMA said
The museum states it notified law enforcement, engaged third-party cybersecurity experts, and is mailing notices under applicable law. It posted a web notice summarizing impacted data types.
Was I affected by the LACMA data breach?
Watch physical mail and email from LACMA or its vendor. The lawsuit does not replace official notice — but it signals that some victims may only now be learning scope. If you volunteered, donated, or worked at LACMA since the mid-2010s, stay alert.
Action items
- Freeze credit at Equifax, Experian, and TransUnion if your letter lists an SSN (free).
- Monitor medical EOBs if health fields were cited — medical-ID fraud is quieter than card fraud.
- Ignore “LACMA membership refund” links; use lacma.org directly.
- Preserve your notice letter if you join or opt out of litigation later.
- Employees: watch for W-2 and payroll redirect phishing referencing museum HR.
Canonical record and sources
Catalog: lacma-network2025 — recordsAffected 0 pending nationwide census; companyConfirmed true. Related: Nutex Health, Paylogix.
Search coverage: LACMA data breach, LACMA class action lawsuit 2026, Los Angeles County Museum of Art hack, LACMA SSN exposed, museum data breach California, was I affected LACMA.
Genetic-test PHI is irreversible — you cannot rotate a diagnosis like a password. EOB and lab-result phishing spikes for months after clinical lab notices.
Airport parking and WiFi sign-ups feel low-risk until a scammer knows your plate, postcode, and travel dates. MAG-scale contact lists power convincing “your Stansted booking failed” SMS.
Museum and nonprofit breaches often sit quiet for a year before letters — class actions follow when members learn from press, not mail.
Crypto travel platforms hold passports and wallet addresses together — a rare combo for KYC bypass and SIM-swap follow-on.
Hashed passwords still matter when people reuse the same string on email and exchange accounts. Rotate Travala + every reuse; enable hardware MFA on email first.
Texas hunting-license victims already have a dedicated BreachHistory blog — do not confuse TPWD with Texas DPS (a separate 2024 driver-record incident).
Carhartt and Boston Scientific August 2026 blogs are live on BreachHistory — check those canonical pages before re-sharing actor-inflated counts.
Freeze credit when SSN appears in a lab or museum letter; monitor Explanation of Benefits when only insurance IDs were listed.
NCSC and ICO guidance after UK breaches: ignore unexpected payment links; airports never ask for card details by cold call.
Open bookmarks to official portals now so you are not searching under panic later.
Secondary scams include fake IDX enrollment portals and fake “class action payout” forms that harvest more PII.
Support agents become targets when CRM context leaks — brief them before customers forward breach screenshots.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.