LACMA Data Breach Exposes Critical Security Gaps in Cultural Institutions
The Los Angeles County Museum of Art (LACMA) disclosed a significant data breach that occurred in July 2025, where attackers gained unauthorized access to their systems for four days before detection. The incident exposed highly sensitive personal information of customers and employees, including Social Security numbers, medical records, health insurance information, partial financial account details, and government-issued identification numbers. The investigation took over a year to complete, with the full scope of compromised data only identified in February 2026, highlighting the complexity and severity of the breach. This incident underscores the growing threat to cultural institutions and the healthcare sector, as attackers increasingly target organizations storing mixed personal and medical data for identity theft and fraud schemes.
Kill Chain