LACMA Data Breach Exposed Social Security and Medical Data: Incident Response Lessons and Detection Guidance for Defenders

The Los Angeles County Museum of Art (LACMA) has disclosed a data breach from last year that exposed sensitive personal information belonging to both customers and employees — including Social Security numbers and medical data. While museums aren't the first organizations that come to mind as high-value targets, this incident is a textbook illustration of a reality I drill into every client: any organization that holds SSNs and medical records is a regulated-data custodian, whether they think of themselves that way or not.

The combination exposed here is particularly dangerous. SSNs plus medical information is the raw material for medical identity theft, insurance fraud, and highly convincing targeted phishing. Unlike a credit card number, an SSN cannot be reissued — the blast radius of this breach will follow affected individuals for years. For defenders, the operational lesson is that the attackers' dwell time and the organization's delayed discovery (the breach occurred last year, with notification happening now) is the real story. Long discovery gaps are a detection failure, and they are preventable.

In this post I'll break down what we can defensibly infer about this class of intrusion, provide concrete detections your SOC can deploy today for the access patterns that precede PII exfiltration, and lay out the remediation and governance actions that separate organizations that contain these events from organizations that read about themselves in the news.

Technical Analysis: Anatomy of a PII Exfiltration Breach

What We Know

Per the public disclosure, LACMA determined that an unauthorized party accessed systems containing customer and employee records, including Social Security numbers and medical information. As with most breach notifications, forensic specifics — initial access vector, exact dwell time, exfiltration volume — have not been fully published. That is normal: notifications are legal documents, not forensic reports.

What the Pattern Tells Us

Having led dozens of IR engagements with this same disclosure profile, the vast majority of breaches with this shape trace back to one of three initial access vectors:

1. Credential compromise via phishing or credential stuffing — still the leading initial access vector across our casework. A single phished Microsoft 365 or VPN credential with no MFA enforcement gives an attacker legitimate-looking access to file shares, HR systems, and email.
2. Exploitation of an internet-facing remote access service — unpatched VPN concentrators, remote desktop gateways, or web applications fronting internal databases.
3. Third-party/managed service compromise — payroll providers, benefits administrators, and IT support vendors hold exactly this category of data and frequently have standing access into client environments.

The affected data — SSNs and medical records — strongly suggests the intruder reached HR systems, benefits/insurance records, or a shared file repository holding scanned employee documents. Attackers don't exfiltrate medical data by accident; they find it because it sits in predictable locations (HR shares, payroll exports, benefits enrollment PDFs) and because access controls on those repositories are almost universally weaker than on crown-jewel financial systems.

The Defender's Attack Chain View

The observable behaviors that precede a breach like this, regardless of the initial vector:

• Anomalous authentication — logins to VPN, M365, or remote access portals from new geographies, impossible travel, or unfamiliar devices, often outside business hours
• Directory and share enumeration — the intruder hunting for 'HR', 'payroll', 'benefits', 'SSN' in file paths and SharePoint/Teams content
• Bulk read access — a single account reading hundreds or thousands of files in a short window, a pattern no legitimate user produces
• Staging and compression — creation of large archives (ZIP/7z/RAR) in temp or user directories before exfiltration
• Exfiltration — large outbound transfers to cloud storage (Mega, Dropbox, personal OneDrive/Google Drive) or attacker infrastructure

Every one of these is detectable with telemetry most organizations already collect. The gap is rarely tooling — it's that nobody wrote the query.

Detection & Response

The detections below target the behaviors described above. They are tuned to fire on the specific access patterns that precede PII theft — bulk file reads, suspicious archive staging, and anomalous remote authentication — rather than generic noise.

SIGMA Rules

---
title: Bulk File Access on Sensitive HR Data Share
id: 3f8a2c41-7b1e-4d59-a6c2-9e0d5f8b1a34
status: experimental
description: Detects a single user account accessing an abnormally high volume of files within HR, payroll, or benefits directories — a strong precursor to PII exfiltration as seen in breaches like LACMA where SSN and medical records were exposed.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://www.bleepingcomputer.com/news/security/lacma-data-breach-last-year-exposed-social-security-and-medical-data/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\\HR\\'
      - '\\Payroll\\'
      - '\\Benefits\\'
      - '\\Personnel\\'
      - '\\Employee Records\\'
  condition: selection_paths
falsepositives:
  - HR staff performing legitimate batch operations during open enrollment or audits
  - Backup and DLP scanning service accounts (exclude known service accounts)
level: high
---
title: Archive Creation in User or Temp Directories via Command Line
id: 8c4d1e92-3a67-4f28-b5d1-2c9e7a4f6b08
status: experimental
description: Detects compression utilities (7z, rar, tar via command line) creating archives in temp or user profile directories, a common staging behavior before data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.bleepingcomputer.com/news/security/lacma-data-breach-last-year-exposed-social-security-and-medical-data/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r'
  selection_path:
    CommandLine|contains:
      - 'AppData\\Local\\Temp'
      - 'Users\\Public'
      - 'ProgramData'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - IT administrators packaging software for deployment
  - Developers archiving build artifacts
level: medium
---
title: Sensitive Data Filename Enumeration via Command Line
id: 5b2e9f74-1d38-4a60-c7e5-8f3b6d2a9e17
status: experimental
description: Detects command-line searches for files containing keywords associated with SSNs, medical records, and HR data — reconnaissance behavior typical of intruders locating PII before exfiltration.
references:
  - https://attack.mitre.org/techniques/T1083/
  - https://www.bleepingcomputer.com/news/security/lacma-data-breach-last-year-exposed-social-security-and-medical-data/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\findstr.exe'
  selection_keywords:
    CommandLine|contains:
      - 'ssn'
      - 'social security'
      - 'medical'
      - 'passport'
      - 'W-2'
      - 'W2'
      - 'benefits'
      - 'HIPAA'
  condition: selection_img and selection_keywords
falsepositives:
  - Compliance staff running legitimate data discovery scans
  - DLP administration scripts (exclude documented tooling accounts)
level: medium

KQL — Microsoft Sentinel / Defender

This hunt surfaces the two highest-fidelity pre-exfiltration behaviors: anomalous interactive sign-ins to cloud identity (the most common initial access indicator for this breach class) and bulk file access to sensitive shares. Run both over a 7–14 day lookback and baseline against known HR and service accounts.

// Hunt 1: Anomalous sign-ins from new locations/devices followed by mailbox or SharePoint access
// Detects the credential-compromise pattern that commonly precedes PII breaches
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| summarize FirstSeen = min(TimeGenerated), Apps = make_set(AppDisplayName), IPs = make_set(IPAddress), Locations = make_set(Location)
    by UserPrincipalName, DeviceDetail
| extend CountryHits = array_length(Locations)
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(90d)
    | where ResultType == 0
    | summarize HistoricalLocations = make_set(Location) by UserPrincipalName
) on UserPrincipalName
| mv-expand Location = Locations
| where Location !in (HistoricalLocations)
| project UserPrincipalName, FirstSeen, NewLocation = tostring(Location), IPs, Apps
| order by FirstSeen desc;

// Hunt 2: Single account performing high-volume file operations against sensitive HR/payroll paths
// Baseline first: legitimate HR staff will appear — investigate outliers above 3x baseline
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\HR\\", "\\Payroll\\", "\\Benefits\\", "\\Personnel\\", "Employee Records")
    or FileName has_any ("ssn", "w2", "w-2", "medical", "benefits", "passport")
| summarize FileCount = count(), DistinctFiles = dcount(FileName), Files = make_set(FileName, 50)
    by InitiatingProcessAccountName, DeviceName, bin(TimeGenerated, 1h)
| where FileCount > 100
| order by FileCount desc;

// Hunt 3: Large outbound transfers to consumer cloud storage (exfiltration staging)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("mega.nz", "dropbox.com", "wetransfer.com", "file.io", "transfer.sh", "anonfiles")
    or RemoteIP in (externaldata(remoteip:string)[@"https://your-threat-feed"] with (format="csv"))
| join kind=inner (DeviceProcessEvents | project ProcessId, FileName, ProcessCommandLine, DeviceId, TimeGenerated) 
    on $left.InitiatingProcessId == $right.ProcessId
| summarize Connections = count(), URLs = make_set(RemoteUrl) by InitiatingProcessAccountName, DeviceName, FileName
| order by Connections desc;

Velociraptor VQL

This artifact hunts endpoints for archive staging behavior — compressed files recently created in temp/public directories — and cross-references with processes that executed compression tooling. Deploy as a fleet-wide hunt when you suspect staging activity, or as a scheduled monthly sweep on servers hosting HR/finance data.

-- Hunt for recently staged archives and compression tool execution
-- Targets pre-exfiltration staging behavior observed in PII theft cases

LET archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.zip',
                 'C:/Users/*/AppData/Local/Temp/*.7z',
                 'C:/Users/*/AppData/Local/Temp/*.rar',
                 'C:/Users/Public/**/*.zip',
                 'C:/Users/Public/**/*.7z',
                 'C:/ProgramData/**/*.rar'])
WHERE Mtime > now() - 86400 * 14
  AND Size > 10000000

SELECT FullPath AS StagedArchive,
       Size / 1048576 AS SizeMB,
       Mtime AS LastModified,
       Btime AS Created
FROM archives
ORDER BY SizeMB DESC

Hardening Script — Verify MFA and Audit Sensitive Share Access

This PowerShell script performs two high-value verification actions for this breach class: auditing MFA registration gaps on accounts with access to sensitive systems (Microsoft 365) and enabling detailed file access auditing on HR/payroll shares. Run the M365 portion with the Microsoft Graph PowerShell SDK and appropriate read scopes; run the SACL portion on the file server hosting the shares.

# ============================================================
# PART 1: Identify accounts WITHOUT strong MFA (M365 / Entra ID)
# Requires: Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","User.Read.All"
# ============================================================

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","User.Read.All" -NoWelcome

$report = @()
$users = Get-MgUser -All -Property "Id,DisplayName,UserPrincipalName,AccountEnabled" | Where-Object { $_.AccountEnabled -eq $true }

foreach ($u in $users) {
    $methods = Get-MgUserAuthenticationMethod -UserId $u.Id -ErrorAction SilentlyContinue
    $methodTypes = $methods.AdditionalProperties.'@odata.type'
    $hasStrongMFA = ($methodTypes -match 'microsoftAuthenticatorAuthenticationMethod|fido2AuthenticationMethod|windowsHelloForBusinessAuthenticationMethod').Count -gt 0

    if (-not $hasStrongMFA) {
        $report += [PSCustomObject]@{
            UserPrincipalName = $u.UserPrincipalName
            DisplayName       = $u.DisplayName
            AuthMethods       = ($methodTypes -join '; ')
            Risk              = 'NO STRONG MFA — phishable or no second factor'
        }
    }
}

$report | Export-Csv -Path ".\Accounts_Without_Strong_MFA_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "[!] $($report.Count) enabled accounts lack strong MFA. Review the CSV and remediate before anything else."

# ============================================================
# PART 2: Enable file-access auditing on sensitive HR/payroll shares
# Run on the file server. Adjust $sensitivePaths to your environment.
# ============================================================

# Ensure Object Access auditing is enabled
auditpol /set /subcategory:"File System" /success:enable /failure:enable

$sensitivePaths = @('D:\Shares\HR', 'D:\Shares\Payroll', 'D:\Shares\Benefits')

foreach ($path in $sensitivePaths) {
    if (Test-Path $path) {
        $acl = Get-Acl $path
        $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            'Everyone',
            'Read,ReadData,WriteData,Delete,ChangePermissions',
            'ContainerInherit,ObjectInherit',
            'None',
            'Success'
        )
        $acl.AddAuditRule($auditRule)
        Set-Acl -Path $path -AclObject $acl
        Write-Host "[+] Audit SACL applied to $path"
    } else {
        Write-Host "[-] Path not found, skipping: $path"
    }
}

# Verify: successful reads on these shares will now generate Event ID 4663,
# which feeds directly into the 'Bulk File Access' Sigma rule above.

Remediation & Hardening

For Organizations Responding to a Similar Breach Right Now

1. Engage DFIR before you touch anything. If you suspect unauthorized access to systems holding SSNs or medical data, preserve volatile evidence (authentication logs, VPN logs, EDR telemetry) immediately. Retention windows on M365 sign-in logs and firewall logs are frequently 30–90 days — every week of delay destroys evidence.
2. Force enterprise-wide credential resets, prioritizing accounts with access to HR, payroll, and file shares. Revoke all active sessions and refresh tokens in Entra ID/Okta — a password reset alone does not kill an established session.
3. Determine scope before notification. Your legal notification obligations (state breach statutes, and HIPAA if medical data involves a covered entity relationship) depend on what was accessed, not just what was present. This requires forensic analysis, not assumption.
4. Notify and support affected individuals — credit monitoring is table stakes; given medical data exposure, include medical identity theft monitoring and clear guidance on placing fraud alerts and credit freezes with all three bureaus.

Structural Defenses — Preventing the Next LACMA

• Enforce phishing-resistant MFA (FIDO2/passkeys or at minimum Authenticator with number matching) on every account, no exceptions for executives, service accounts with interactive rights, or 'temporary' users. Credential compromise remains the dominant vector for exactly this breach profile.
• Data discovery and minimization. You cannot protect PII you don't know you hold. Run data classification scans across file shares, SharePoint, and endpoints for SSN and medical record patterns. Then ask the harder question: why does the museum's web store database have retention access to employee medical files? Segregate and purge.
• Network segmentation for HR/finance systems. HR repositories should sit behind dedicated access controls, with access logged and alerted — not reachable from every workstation on the flat network.
• Deploy the detections above. Bulk-read alerting on sensitive shares is a 30-year-old control that remains criminally underdeployed. The Sigma and KQL content in this post is a starting baseline.
• DLP with egress controls. Alert on (and for the highest-risk segments, block) outbound transfers to consumer file-sharing services and uploads containing SSN patterns.
• Review third-party access. Payroll, benefits, and IT support vendors with standing access into your environment must be held to your MFA and logging standard, with access reviewed quarterly.
• Tabletop this scenario. If your IR plan doesn't have a runbook for 'unauthorized party accessed HR records, discovery date uncertain,' it will fail when you need it. Dwell time and late discovery are the norm — plan for them.

The Governance Lesson

LACMA is a cultural institution, not a hospital or a bank — yet it held the same class of data that makes those organizations regulated targets. Every nonprofit, university, museum, and mid-market business should take the same message: your regulatory and threat exposure is defined by the data you hold, not the industry you're in. If your environment stores SSNs and medical records, you need the detection coverage, access controls, and response readiness of a regulated entity — because the attackers already treat you like one.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub