The Los Angeles County Museum of Art’s recently announced 2025 data breach has resulted in a lawsuit filed by a former employee who alleges the museum waited nearly a year to tell him his personal information may have been compromised.
Adam Piron’s proposed Los Angeles Superior Court lawsuit alleges negligence-based claims as well as unjust enrichment. Piron requests a court order preventing from engaging in further such alleged misconduct. The Loma Linda man further seeks unspecified damages and asks the court to direct LACMA to implement the appropriate security measures.
A LACMA representative did not immediately reply to a request for comment on the suit brought Tuesday.
LACMA published a notice on Monday that on July 11, 2025, suspicious activity was detected on their computer systems.
“We immediately began working with third-party cybersecurity experts to investigate and remediate that activity,” the statement read. “In August 2025, the investigation found that an unauthorized third party gained access to a portion of our computer network from July 7 to 11, 2025.”
According to the LACMA statement, a data review firm’s investigation identified that the following types of personal information may have been accessed: full name, date of birth, Social Security number, driver’s license or government-issued identification number, limited financial account numbers, limited payment card information, health-insurance information and limited medical information such as provider name, medical treatment, diagnosis, treatment dates or treatment locations. The categories of data varied across individuals.
LACMA is one of the nation’s largest art museums and attracts nearly a million visitors annually. Piron and the proposed class members provided their personal information as a part of their customer or employment relationship, the suit states. Piron worked for LACMA in 2018-20.
“By obtaining, collecting, using and deriving a benefit from the plaintiff’s and class members’ (personal information), LACMA assumed legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion,” the suit states.
Piron “greatly values his privacy and is very careful about sharing his sensitive (personal information),” the suit states.
Piron, 40, and the proposed class members now face a life-long risk of identity theft and the sharing and detrimental use of their sensitive information, according to the complaint.
LACMA allegedly never notified Piron of the data breach until June of this year and as a result, he was unaware his personal information had been compromised and continued to be at significant risk of identity theft and various other forms of personal, social, and financial harm, the suit further states.