Madison Square Garden Entertainment: MSG Accused of Exposing Fan Data

Madison Square Garden Hit with Class Action Lawsuit Over Massive Data Breach

Madison Square Garden Entertainment (MSG Entertainment) faces a proposed class action lawsuit after cybercrime group ShinyHunters claimed to have breached its systems, exposing sensitive data from up to 26 million visitors. The lawsuit, filed in New York federal court on Tuesday, alleges the hack compromised biometric facial recognition data, background checks, credit scores, and Social Security numbers information collected through controversial surveillance systems at the arena.

The breach was disclosed one day after the New York Knicks secured the 2025-26 NBA championship in San Antonio. ShinyHunters initially demanded a ransom before publishing 42 gigabytes of stolen data, including internal risk assessments of high-profile figures like actor Ben Stiller (labeled "low risk") and rapper A Boogie wit da Hoodie ("high risk").

Plaintiff Carlos Avalo, who attended a concert at MSG in September 2025, claims his personal data was among the exposed records. The lawsuit criticizes MSG Entertainment’s response as "woefully insufficient", noting the company has yet to notify affected individuals. As of Wednesday, MSG had not issued a public statement.

This is not the first breach for MSG. The lawsuit highlights two prior incidents one a decade ago and another in 2024 where hackers accessed consumer data, including credit card and Social Security numbers. Despite these incidents, the company continued collecting biometric data, drawing criticism from privacy advocates and New York Attorney General Letitia James, who previously scrutinized MSG’s use of facial recognition to ban lawyers from games over litigation disputes.

The complaint, which includes negligence claims, seeks at least $5 million in damages and could expand to cover millions of affected individuals. The case underscores growing cybersecurity risks in the sports industry, with a recent Darktrace report finding 84% of surveyed sports organizations experienced at least one cyber incident in the past year. MSG Entertainment, led by CEO James Dolan, remains the sole defendant, while its sister company, Madison Square Garden Sports (owner of the Knicks and Rangers), is not named in the suit.

Source: https://frontofficesports.com/newsletter/msg-accused-of-exposing-fan-data/

Madison Square Garden Entertainment Corp. cybersecurity rating report: https://www.rankiteo.com/company/msg-entertainment

"id": "MSG1781727891",
"linkid": "msg-entertainment",
"type": "Breach",
"date": "9/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Up to 26 million visitors',
                        'industry': 'Sports and Entertainment',
                        'location': 'New York, USA',
                        'name': 'Madison Square Garden Entertainment (MSG '
                                'Entertainment)',
                        'type': 'Entertainment Company'}],
 'data_breach': {'data_exfiltration': True,
                 'number_of_records_exposed': 'Up to 26 million',
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Biometric facial recognition '
                                              'data',
                                              'Background checks',
                                              'Credit scores',
                                              'Social Security numbers']},
 'description': 'Madison Square Garden Entertainment (MSG Entertainment) faces '
                'a proposed class action lawsuit after cybercrime group '
                'ShinyHunters claimed to have breached its systems, exposing '
                'sensitive data from up to 26 million visitors. The breach '
                'included biometric facial recognition data, background '
                'checks, credit scores, and Social Security numbers.',
 'impact': {'brand_reputation_impact': 'Significant',
            'data_compromised': 'Biometric facial recognition data, background '
                                'checks, credit scores, Social Security '
                                'numbers',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Class action lawsuit seeking at least $5 '
                                 'million in damages',
            'payment_information_risk': 'High'},
 'initial_access_broker': {'high_value_targets': ['Ben Stiller',
                                                  'A Boogie wit da Hoodie']},
 'investigation_status': 'Ongoing',
 'motivation': 'Ransom, Data Exfiltration',
 'ransomware': {'data_exfiltration': True, 'ransom_demanded': True},
 'references': [{'source': 'Class action lawsuit filing'},
                {'source': 'Darktrace report on sports industry cyber '
                           'incidents'}],
 'regulatory_compliance': {'legal_actions': ['Class action lawsuit',
                                             'Scrutiny from New York Attorney '
                                             'General Letitia James']},
 'response': {'communication_strategy': 'Woefully insufficient; no public '
                                        'notification to affected individuals'},
 'threat_actor': 'ShinyHunters',
 'title': 'Madison Square Garden Hit with Class Action Lawsuit Over Massive '
          'Data Breach',
 'type': 'Data Breach'}