LACMA data breach last year exposed social security and medical data

In July 2025, LACMA detected unauthorized access to its network that began four days prior. An investigation revealed that attackers accessed sensitive personal information such as full names, dates of birth, social security numbers, government-issued IDs, partial financial account and payment card information, health insurance details, and medical treatment data. Notifications and support services were provided to affected individuals, including identity theft protection enrollment. The museum has involved law enforcement but has not publicly disclosed the attack vector or the total number of impacted individuals.

The breach exposed highly sensitive personal data, including social security numbers and medical information, which could lead to identity theft, financial fraud, and privacy violations for affected individuals. The exposure of partial financial and payment card information further increases the risk of financial exploitation. The breach affects both customers and employees, potentially amplifying the scope of impact.

LACMA has notified impacted individuals and law enforcement authorities. Affected persons are advised to monitor financial accounts, consider credit freezes or fraud alerts, and report any identity theft attempts. Enrollment in a one-year identity theft and fraud protection service is offered. No specific technical remediation or patch is applicable as this is a breach incident. Organizations should review and enhance their detection and response capabilities to identify suspicious activity promptly.