LACMA discovered a cybersecurity breach in July 2025. It did not tell the people affected until August 2026, more than a year later, after confirming their names, Social Security numbers, and health information had been exposed.
Museum Associates, doing business as LACMA (the Los Angeles County Museum of Art), has notified customers and employees of a data security incident. According to LACMA’s own notice, the museum detected suspicious activity on its computer systems on July 11, 2025. An investigation with third-party cybersecurity experts determined that an unauthorized third party had access to a portion of LACMA’s network between July 7 and July 11, 2025.
LACMA engaged a data-review firm to analyze the files potentially affected and received initial results in late February 2026. The museum posted notice to the California Attorney General and to its own website on August 24, 2026, roughly 13 months after it first detected the intrusion and about six months after receiving its initial data-review results.
The length of time between LACMA’s discovery of the breach and its notice to affected individuals is one of the most significant facts in this case. LACMA detected the intrusion in July 2025 but did not notify customers and employees until August 2026. Even after LACMA received its initial data-review results in February 2026, confirming what information had been exposed, it took roughly another six months before notice went out. During all of that time, affected individuals had no way to know their Social Security numbers, financial information, or health information might be at risk.
LACMA’s notice states that the categories of data varied across individuals, but confirms that the following types of information may have been accessed:
LACMA’s notice does not mention a credit monitoring, identity theft protection, or other remedy being offered to affected individuals. The notice instead directs people to general steps, such as reviewing account statements and credit reports and considering a fraud alert or credit freeze, and provides a call center at (844) 953-2547 for questions.
Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage this kind of data are legally required to safeguard it. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.
LACMA’s notice also confirms that health insurance information and limited medical information were among the data types involved. This kind of information may qualify as Protected Health Information (PHI) under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.
Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.
Organizations that collect Social Security numbers, financial information, and health information have a legal duty to safeguard that data and to notify affected individuals within a reasonable time after discovering a breach. Customers and employees affected by this incident may have rights and remedies under California and federal law, including claims tied to the length of time it took LACMA to disclose what happened.
How many people were affected by the LACMA data breach?
LACMA has not disclosed a total number of affected individuals, either in its California Attorney General filing or its own website notice.
What happened, and when?
An unauthorized third party accessed a portion of LACMA’s computer network between July 7 and July 11, 2025. LACMA detected the activity on July 11, 2025, received initial data-review results in late February 2026, and posted notice to affected individuals, the California Attorney General, and its own website on August 24, 2026.
Why did it take so long to notify affected people?
LACMA’s notice does not explain the reason for the roughly 13-month gap between detection and notice, including the additional six months between receiving its initial data-review results and posting notice.
Is LACMA offering credit monitoring or identity theft protection?
LACMA’s notice does not mention a credit monitoring or identity protection offer. It directs affected individuals to general steps like reviewing account statements, checking credit reports, and considering a fraud alert or credit freeze.
What should I do if I received this notice, or if I am a current or former LACMA customer or employee?
Review your account statements and free credit reports for suspicious activity. Consider placing a fraud alert or credit freeze on your credit file. Report any suspicious activity to your financial institutions and law enforcement, and consider speaking with a data breach attorney about your options.
Do I have a legal claim?
You may. Organizations that collect sensitive personal and health information are required by law to protect it and to notify affected individuals without unreasonable delay. Contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or emeryreddy.com for a Free Case Review. No Fee Unless We Recover.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
