Loading story…
The Los Angeles County Museum of Art (LACMA) disclosed that a network compromise may have exposed sensitive information belonging to visitors, customers, and employees, including Social Security numbers, personal and financial data, health-insurance information, and medical records. LACMA detected suspicious activity on July 11, 2025, found that the activity had begun four days earlier, and confirmed a network compromise about a month later; by late February 2026, its investigation determined the attacker may have accessed the sensitive data.
LACMA notified law enforcement and affected individuals, though it did not disclose the attack method or number of people affected. The museum is offering one year of Financial Shield identity-theft and fraud-protection services and advises recipients to monitor their accounts and consider credit freezes or fraud alerts.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Initial investigation results indicated that an attacker may have accessed names, dates of birth, Social Security and identification numbers, partial financial and payment-card data, health-insurance data, and medical information.
About one month after detecting the suspicious activity, LACMA confirmed that its network had been compromised. The museum initially could not determine the types of data exposed.
The Los Angeles County Museum of Art detected suspicious activity in its systems and began investigating the incident.
LACMA said the suspicious activity associated with the incident began four days before it was detected.
LACMA notified law enforcement and sent individualized breach notifications to affected people, offering one year of Financial Shield identity-theft and fraud-protection services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Madera Community Hospital disclosed a data breach affecting **150,810 individuals** after an unauthorized party accessed its internal network for two days in late May 2025 and likely acquired files from part of the environment. The California hospital said the exposed information included names, contact details, dates of birth, Social Security numbers, login credentials, financial account information, treatment and health insurance data, and limited biometric information. The hospital detected the intrusion on **May 29, 2025**, initially found no evidence of file theft during its early investigation, and later concluded that data had likely been exfiltrated. It said an extortion group was behind the incident and had issued a ransom demand before reportedly withdrawing it after learning the victim was a hospital and saying it did not want to harm patients. Madera Community Hospital said it secured the affected network, hired third-party cybersecurity and data-review firms, notified law enforcement and the US Department of Health and Human Services, and began notifying affected individuals in mid-July 2026 after receiving data-review results in April 2026.
Aug 5, 2026
Nacogdoches Memorial Hospital in Texas disclosed that a January cyberattack exposed the personal and medical information of **257,073 patients** after attackers gained access to its network on **January 15** and remained undetected for roughly two weeks. Public reporting and breach notification materials indicate the stolen data included names, Social Security numbers, medical record numbers, health insurance and health plan beneficiary details, and other sensitive healthcare information; the hospital also said patient photos may have been affected. The regional medical center said it has not identified misuse of the stolen data so far, but the scale and sensitivity of the breach make it a significant healthcare privacy incident. In response, the hospital said it implemented additional network security measures and security awareness training, while reports noted it did **not** offer complimentary credit monitoring to affected individuals and did not provide further detail on the intrusion or whether employee and support staff data was also compromised.
Jun 29, 2026
Several major organizations in the healthcare and insurance sectors have disclosed significant data breaches affecting millions of individuals. ARC Community Services reported a ransomware attack by the INC Ransom group, resulting in the exfiltration of sensitive patient data, including health and financial information. Aflac confirmed that a June cyberattack led to the theft of files containing insurance claims, health data, and Social Security numbers for over 22 million customers, with no operational disruption but widespread exposure of personal information. The Louisiana Office of Student Financial Assistance (LOSFA) notified students of unauthorized access to its systems, exposing names and Social Security numbers, though certain savings accounts were not affected. Oklahoma Spine Hospital agreed to a $1.1 million settlement following a July breach that compromised the data of nearly 39,000 patients, including medical and financial details. These incidents highlight the ongoing threat posed by cybercriminals targeting sensitive data in the healthcare and insurance industries. Victims in these breaches are being offered credit monitoring and identity protection services, and regulatory notifications have been issued. The attacks have prompted legal action, regulatory scrutiny, and, in some cases, leadership changes within affected organizations. Law enforcement and cybersecurity experts have been engaged to investigate and mitigate the impact of these breaches, which are part of a broader trend of targeted attacks against organizations handling large volumes of personal and health-related information.
Jun 29, 2026