Former LACMA Curator Sues Museum, Says It Sat on Data Breach for a Year

A former Los Angeles County Museum of Art curator has sued the institution, claiming it sat on knowledge of a data breach for nearly a year before telling him that hackers may have accessed his Social Security number and other sensitive personal information. Adam Piron, who worked at LACMA as an assistant curator and film curator from 2018 to 2020, filed the proposed class-action lawsuit in Los Angeles Superior Court against the museum over an intrusion the institution says it first detected in the summer of 2025.

According to the lawsuit, as reported by MyNewsLA.com, LACMA detected suspicious activity on its computer systems on July 11, 2025, and later determined that an unauthorized third party had accessed part of its network between July 7 and July 11 of that year. Piron, now 40 and living in Loma Linda, says he was not notified that his personal information may have been compromised until June, and that he had no way of knowing about the exposure before that notice arrived. The museum has said the personal information that may have been accessed included full names, dates of birth, Social Security numbers, driver's license or other government-issued identification numbers, limited financial account numbers, limited payment card information, health insurance information, and other data that varied from person to person, per the outlet's report.

A Yearlong Gap Between Detection and Disclosure

The timeline described in the lawsuit lines up with LACMA's own regulatory filings. The museum, whose formal operating entity is Museum Associates, filed a data security breach notification with the California Attorney General's Office on August 24, disclosing the same July 2025 intrusion window. It also filed a parallel notice with the Vermont Attorney General's Office the following day, indicating the compromised data reached residents outside California as well.

That gap between detection and disclosure appears to trace back to the forensic process itself. Per a breach summary from law firm Emery Reddy, a third-party data-review firm did not complete its initial file analysis identifying which individual records were compromised until late February 2026 — more than seven months after the anomalies were first detected. LACMA has said it worked with third-party cybersecurity experts to investigate and remediate the suspicious activity, though a museum representative did not immediately reply to a request for comment on the lawsuit, according to MyNewsLA.com.

New State Law Sets a 30-Day Clock

The delay lands amid a tightening of California's breach-notification rules. Under Senate Bill 446, which amended Civil Code § 1798.82 effective January 1, businesses and entities holding personal data now face a strict 30-calendar-day deadline to notify affected state residents after discovering a breach, according to a legal analysis from Moore & Van Allen. The law replaced a more flexible standard that simply required notice “without unreasonable delay,” specifically to prevent the kind of prolonged lag alleged in Piron's complaint. Separately, organizations reporting a breach affecting more than 500 California residents must notify the state attorney general within 15 calendar days of notifying affected consumers, per guidance from the Bibiyan Law Group.

Piron's suit brings negligence-based claims and unjust enrichment against LACMA, alleging the museum assumed legal and equitable duties to protect the personal information of Piron and proposed class members from unauthorized access and intrusion. The complaint states that Piron and other class members provided their personal information through their customer or employment relationships with the museum, and that they now face a lifelong risk of identity theft and the sharing or detrimental use of their sensitive information. He is seeking unspecified damages, along with a court order directing LACMA to implement appropriate security measures and to prevent further alleged misconduct.

From LACMA Curator to Sundance's Indigenous Program

Piron's tenure at LACMA put him in the museum's film programming ranks before he moved on to a prominent national role. He was appointed Director of the Indigenous Program at the Sundance Institute in March 2022, following his 2018-to-2020 stint overseeing film curation at the Los Angeles museum.

A Recurring Target Across the Museum World

LACMA, which is managed by the nonprofit public benefit corporation Museum Associates under a public-private partnership with Los Angeles County, is described in the lawsuit as one of the nation's largest art museums, drawing nearly a million visitors annually. Large cultural institutions like it maintain centralized databases holding high-net-worth donor financial details, member records, and employee human resources files — including Social Security numbers, background checks, and tax records — according to a review by Class Action Lawsuit Review, making them attractive targets for cybercriminals.

The art world has faced a string of similar incidents in recent years. A 2020 breach at online marketplace LiveAuctioneers exposed personal details belonging to 3.4 million users, as detailed by the Observer. And in December 2023, a ransomware attack on software vendor Gallery Systems encrypted database systems relied on by more than 800 cultural organizations, including the Metropolitan Museum of Art and MoMA, according to Bleeping Computer. Piron's complaint, according to court filings, alleges he continues to face a significant risk of identity theft and other personal, social, and financial harm as a result of the breach.