{"id":"madison-square-garden-records-leaked-jun-2026","category":"breach","status":"closed","title":"Madison Square Garden customer and celebrity records published, exposing 9.8 million email addresses","tldr":"ShinyHunters published MSG staff, customer and celebrity records; HIBP lists 9.8 million unique email addresses. Check your email exposure and independently verify messages or calls referring to MSG visits, tickets or customer enquiries.","summary":"ShinyHunters published stolen Madison Square Garden information in June 2026 following an extortion campaign. Have I Been Pwned recorded approximately 9.8 million unique email addresses across staff and customer data, with names, telephone numbers, postal addresses and customer-service records. That is an email-address count, not a company-confirmed count of affected people. Samples examined by 404 Media also included celebrity and sporting-personality records with contact details and risk assessments. Its follow-up attributed the intrusion to an employee being deceived over the telephone. In July, MSG acknowledged that an extortion group stole customer relationship management data, while disputing WIRED’s interpretation of celebrity records and filing a defamation lawsuit; WIRED stood by its reporting. As of 3 November, the sources reviewed do not establish completed customer notifications, containment, removal of published copies or a final legal outcome. There is no consumer software patch for this exposure.","action":"Check your email address with Have I Been Pwned. Verify unexpected ticket offers, refunds or calls through contact details you find independently, even if the sender knows about your MSG visits or enquiries. If your family’s private contact or celebrity records may be involved, ask MSG what information was exposed.","product":"Madison Square Garden staff, customer and celebrity records","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["madison-square-garden","data-breach","shinyhunters","extortion","privacy"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"post","title":"MSG Entertainment files lawsuit against WIRED Magazine","url":"https://mcusercontent.com/5148bae9b0c1552cfa0936d3c/files/5d4acf1c-689a-d80d-bd52-396c3e88b353/Press_Release_MSG_Entertainment_Files_Lawsuit_Against_Wired_7.16.26.pdf","by":"MSG Entertainment","date":"2026-07-16"},{"kind":"research","title":"Madison Square Garden Sports Data Breach","url":"https://haveibeenpwned.com/Breach/MadisonSquareGardenSports","by":"Have I Been Pwned","date":"2026-06-24"},{"kind":"news","title":"Hackers Publish Knicks and Madison Square Garden Data Online","url":"https://www.404media.co/hackers-publish-knicks-and-madison-square-garden-data-online/","by":"404 Media","date":"2026-06-16"},{"kind":"news","title":"How Hackers Broke into Madison Square Garden","url":"https://www.404media.co/how-hackers-broke-into-madison-square-garden/","by":"404 Media","date":"2026-06-24"},{"kind":"news","title":"MSG Suing Wired Over Article Alleging Company Kept Database Of LGBTQIA Celebrities","url":"https://stereogum.com/2505492/msg-suing-wired-over-article-alleging-company-kept-database-of-lgbtqia-celebrities/news","by":"Stereogum","date":"2026-07-16"}],"started":"2026-06-05","closed":"2026-07-16","created":"2026-11-03T21:01:05.909Z","updated":"2026-11-03T21:01:05.909Z","cve_notes":[],"timeline":[{"at":"2026-07-16","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"WIRED said it stood by its reporting and would defend the lawsuit, according to a statement reproduced by Stereogum.","url":"https://stereogum.com/2505492/msg-suing-wired-over-article-alleging-company-kept-database-of-lgbtqia-celebrities/news","by":"Stereogum","patch":null},{"at":"2026-07-16","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"MSG Entertainment acknowledged that an extortion group stole information from its customer relationship management platform. It announced a defamation lawsuit against WIRED over the interpretation of celebrity information, saying the records supported customer relationships and inclusion.","url":"https://mcusercontent.com/5148bae9b0c1552cfa0936d3c/files/5d4acf1c-689a-d80d-bd52-396c3e88b353/Press_Release_MSG_Entertainment_Files_Lawsuit_Against_Wired_7.16.26.pdf","by":"MSG Entertainment","patch":null},{"at":"2026-06-24","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Have I Been Pwned added the breach, recording approximately 9.8 million unique email addresses alongside names, telephone numbers, postal addresses and customer-service records.","url":"https://haveibeenpwned.com/Breach/MadisonSquareGardenSports","by":"Have I Been Pwned","patch":null},{"at":"2026-06-24","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"404 Media reported that the intrusion involved an employee being deceived over the telephone, citing the attackers and its examination of stolen records. It reported that more than 45GB was stolen.","url":"https://www.404media.co/how-hackers-broke-into-madison-square-garden/","by":"404 Media","patch":null},{"at":"2026-06-16","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"404 Media reported that ShinyHunters had published stolen MSG data. Samples included customer correspondence and records about sporting personalities and celebrities, including contact details and risk assessments.","url":"https://www.404media.co/hackers-publish-knicks-and-madison-square-garden-data-online/","by":"404 Media","patch":null},{"at":"2026-06-05","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"ShinyHunters said it broke into Madison Square Garden on this date, according to 404 Media. This is the attackers’ account of when access began.","url":"https://www.404media.co/hackers-publish-knicks-and-madison-square-garden-data-online/","by":"404 Media","patch":"na"}],"url":"https://hard.fyi/live/madison-square-garden-records-leaked-jun-2026/","json":"https://hard.fyi/api/live?id=madison-square-garden-records-leaked-jun-2026"}