The 595John Michael Kohler Arts Center (JMKAC) Data Breach: Incident Facts and Free Case Review

In 2026, the organization reported a major cybersecurity incident to the Indiana Attorney General, highlighting vulnerabilities within its digital infrastructure. While non-profit arts and cultural institutions often operate under constraints that limit dedicated cybersecurity resources, breaches of this nature typically involve unauthorized network intrusions, the deployment of ransomware, or compromises within third-party vendor platforms utilized for ticketing, donor management, and human resources. Unauthorized actors frequently exploit these entry points to infiltrate internal databases, exfiltrate confidential files, and disrupt daily operations before organizations realize the full scope of the compromise.

The data exposed in incidents affecting organizations like JMKAC frequently includes a combination of sensitive personal identifiers, financial details, and employment-related records. When categories such as names, dates of birth, Social Security numbers, banking details, and contact information are compromised, victims face severe, long-term risks. Exposure of financial and banking details opens individuals up to immediate risks of account takeover and fraudulent transactions, while the compromise of core identifiers like Social Security numbers creates a persistent danger of synthetic identity fraud and unauthorized credit applications that can disrupt victims' lives for years.

As a custodian of sensitive consumer and employee data, the John Michael Kohler Arts Center (JMKAC) had clear legal obligations under state data protection laws and common law principles of negligence to implement robust administrative, technical, and physical safeguards. These standards require organizations to maintain adequate encryption, conduct regular security assessments, and monitor networks for anomalous activity. The occurrence of a significant data breach strongly suggests a potential failure to maintain these required security standards, raising serious questions regarding whether the institution lived up to its duty of care toward the individuals whose data it collected.

Receiving an official data breach notification letter from JMKAC serves as formal legal acknowledgment that your confidential information was compromised due to inadequate data security practices. Under established legal standards, affected individuals possess the standing to participate in class action litigation aimed at holding the organization accountable for failing to safeguard their private information. Importantly, victims do not need to demonstrate actual financial loss or identity theft to pursue legal remedies; the increased risk and anxiety caused by the exposure alone are sufficient. Our firm evaluates these data breach claims on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.