A former employee of the Los Angeles County Museum of Art has filed a class action complaint against the institution over a 2025 data breach that he claims has compromised sensitive visitor and employee information, including Social Security numbers.
The complaint accuses LACMA of acting negligently by waiting nearly a year to inform its staff of the breach and seeks unspecified damages, as well as a court-ordered assurance of stronger security measures.
The lawsuit, reviewed by ARTnews, was filed Tuesday in the Superior Court of the State of California by Adam Piron on behalf of “all persons” whose information was compromised by, what the complaint describes as, LACMA’s failure to protect the personal data with which it had been entrusted. It also asks that LACMA be compelled to maintain adequate security practices and act with swift transparency after any future data breach.
“By obtaining, collecting, using and deriving a benefit from the plaintiff’s and class members’ [personal information], LACMA assumed legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion,” the complaint reads.
LACMA is the largest art museum in the Western US, with a collection of some 155,000 objects, spanning six millennia of history, according to its website. Earlier this year, it opened its long-awaited David Geffen Galleries to showcase the permanent collection, which ARTnews described as having the “potential to rewrite art history.” It attracts over 1 million visitors annually, per the suit.
According to the complaint, LACMA experienced a data breach on or around July 11, 2025, during which cybercriminals accessed “personally identifiable information,” including addresses, dates of birth, driver’s license information, health insurance details, and financial account numbers.
LACMA publicized the data breach this past Monday in a statement posted to its website, which confirmed that suspicious activity was detected on their computer systems last July. “We immediately began working with third-party cybersecurity experts to investigate and remediate that activity,” the statement reads. “In August 2025, the investigation found that an unauthorized third party gained access to a portion of our computer network from July 7 to 11, 2025.”
LACMA did not immediately reply to ARTnews’s request for further comment.
The museum’s statement lists the same personal information identified in the complaint as having been compromised, and added that categories of data varied across individuals. “We also notified law enforcement. We are providing notification to affected individuals under applicable law and posting notice to our website,” the statement adds.
Piron, 40, of San Bernardino County, worked as an assistant film curator at the museum from 2018 to 2020, according to his LinkedIn. He said he learned of the data breach prior to Monday’s statement, in June 2026. Still, nearly a year after the incident, he and others affected were left “unable to take the necessary precautions to prevent future fraud and mitigate damages,” the complaint states.
It adds that the plaintiff and museum goers “now face years of constant surveillance of their financial and personal records, monitoring, and loss of their rights.”
