HackingOtherCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Phoenix Art Museum

bd_98396ff1b781d70c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 8, 2025

Filed

Apr 15, 2026

To disclose

—

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Phoenix Art Museum →

Phoenix Art Museum experienced unauthorized access to its network on December 3, 2025, discovered on December 8, 2025. The breach affected one Nebraska resident, exposing their name and Social Security Number. The Museum notified the resident on April 15, 2026, and offered one year of credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

Incident timeline

undetected · 5 days

Dec 3, 2025

Begins

Dec 8, 2025

Discovered

Apr 15, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by rhysida about this victim predates this filing by 128 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siterhysidabd_c6a5e44c7e4012fb2026-02-12 · +61dVerified by operator
Leak Siterhysidabd_765688756f67df5c2025-12-08 · +128dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_6923d15440e132e82026-04-15Candidate
Massachusetts State AGbd_8f6a417b581393b42026-04-15Verified
Maine State AGbd_ec3fa204c92e6f6e2026-04-15Verified

Name: Phoenix Art Museum
norm: phoenix art museum
Domain: phxart.org

Name: Phoenix Art Museum
norm: phoenix art museum
Domain: phxart.org
Industry: Otherllm

Discovered: Dec 8, 2025
Breach occurred: Dec 3, 2025
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Secured the network
Launched an investigation
Mailed a notification letter via First-Class mail
Offering a complimentary, one-year membership to credit monitoring and identity protection services
Changes made: Enhance already existing security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGApr 15 · first

Massachusetts State AGApr 15 · first

Maine State AGApr 15 · first

Nebraska State AGApr 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/fff3e5e5-a5c0-41ce-b4c1-633f76c50495.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2026
Raw hash: 058bc75c34040e2089db14423f16938b8239bf2985ac4b503eb8600a376e47f1

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityPhoenix Art Museum

Victim entityPhoenix Art Museum

Incidentdiscovered Dec 8, 2025

Stated responseSecured the network

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov