Madison Square Garden customer and celebrity records published, exposing 9.8 million email addresses
ShinyHunters published MSG staff, customer and celebrity records; HIBP lists 9.8 million unique email addresses. Check your email exposure and independently verify messages or calls referring to MSG visits, tickets or customer enquiries.
Check your email address with Have I Been Pwned. Verify unexpected ticket offers, refunds or calls through contact details you find independently, even if the sender knows about your MSG visits or enquiries. If your family’s private contact or celebrity records may be involved, ask MSG what information was exposed.
What’s happening
ShinyHunters published stolen Madison Square Garden information in June 2026 following an extortion campaign. Have I Been Pwned recorded approximately 9.8 million unique email addresses across staff and customer data, with names, telephone numbers, postal addresses and customer-service records. That is an email-address count, not a company-confirmed count of affected people. Samples examined by 404 Media also included celebrity and sporting-personality records with contact details and risk assessments. Its follow-up attributed the intrusion to an employee being deceived over the telephone. In July, MSG acknowledged that an extortion group stole customer relationship management data, while disputing WIRED’s interpretation of celebrity records and filing a defamation lawsuit; WIRED stood by its reporting. As of 3 November, the sources reviewed do not establish completed customer notifications, containment, removal of published copies or a final legal outcome. There is no consumer software patch for this exposure.
- What
- Breach
- Affects
- Madison Square Garden staff, customer and celebrity records
- Fixed in
- Nothing to patch
- Since
- 5 June 2026
- Closed
- 16 July 2026
Timeline
- Update
WIRED said it stood by its reporting and would defend the lawsuit, according to a statement reproduced by Stereogum.
- Update
MSG Entertainment acknowledged that an extortion group stole information from its customer relationship management platform. It announced a defamation lawsuit against WIRED over the interpretation of celebrity information, saying the records supported customer relationships and inclusion.
- Update
Have I Been Pwned added the breach, recording approximately 9.8 million unique email addresses alongside names, telephone numbers, postal addresses and customer-service records.
- Update
404 Media reported that the intrusion involved an employee being deceived over the telephone, citing the attackers and its examination of stolen records. It reported that more than 45GB was stolen.
- Made public
404 Media reported that ShinyHunters had published stolen MSG data. Samples included customer correspondence and records about sporting personalities and celebrities, including contact details and risk assessments.
- UpdateNothing to patch
ShinyHunters said it broke into Madison Square Garden on this date, according to 404 Media. This is the attackers’ account of when access began.
Sources
- MSG Entertainment files lawsuit against WIRED MagazineMSG Entertainment · 16 July 2026
- Madison Square Garden Sports Data BreachHave I Been Pwned · 24 June 2026
- Hackers Publish Knicks and Madison Square Garden Data Online404 Media · 16 June 2026
- How Hackers Broke into Madison Square Garden404 Media · 24 June 2026
- MSG Suing Wired Over Article Alleging Company Kept Database Of LGBTQIA CelebritiesStereogum · 16 July 2026