--- title: "Madison Square Garden Sports data incident and publication" description: "Evidence-backed account of Madison Square Garden Sports data incident and publication, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/madison-square-garden-sports-data-publication-2026" markdown_url: "https://www.ally.security/incidents/madison-square-garden-sports-data-publication-2026.md" stix_url: "https://www.ally.security/incidents/madison-square-garden-sports-data-publication-2026/stix.json" --- # Madison Square Garden Sports data incident and publication A data-theft incident followed by public publication of Madison Square Garden and Knicks-related records. A directly reviewed published sample and a later verified HIBP email corpus associated with the incident. Last modified Aug 9, 2026 · 3 sources ## Summary - **Environment:** Not publicly identified - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened A data-theft incident was followed by public publication of [Madison Square Garden Sports](https://www.msgsports.com/) and Knicks-related records. [1](#source-1) [3](#source-3) ## Impact A directly reviewed published sample and a later verified HIBP email corpus associated with the incident. [1](#source-1) Documented data types include: - Names — Names listed for HIBP's verified corpus. [1](#source-1) - Customer service records — Customer service records listed for HIBP's verified corpus; 404 Media separately observed customer emails. [1](#source-1) - Contact information — Email addresses, phone numbers, and physical addresses listed for HIBP's verified corpus. [1](#source-1) A cited record reports 9,796,738 records (Unique email addresses represented in HIBP's verified corpus; not a company-confirmed number of people, customers, staff, accounts, files, or total rows; as of 2026-06-24). [1](#source-1) 404 Media directly observed that Madison Square Garden data had been published online for public download. [3](#source-3) 404 Media reported that the published data included emails between customers and Madison Square Garden. [3](#source-3) ## Timeline ### June 5, 2026 — Documented event HIBP BreachDate and date claimed by an attacker spokesperson to 404 Media; not a victim-confirmed detection or intrusion timestamp. [1](#source-1) ### June 16, 2026 — Public disclosure Date 404 Media published its direct sample review. [3](#source-3) ### June 24, 2026 — Public disclosure Date HIBP added the Madison Square Garden Sports corpus; not a victim-notification date. [1](#source-1) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The cited public record does not establish a specific initial-access vector, malware family, exploited vulnerability, or ATT\&CK technique. ### Actors - ShinyHunters ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response 404 Media reported that a low-level employee was called and tricked into allowing access to MSG systems. The sample reviewed by 404 Media contained files mentioning specific sports teams and Knicks-related personalities, including address, claim-to-fame, talent-cost, and some contact fields. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [2](#source-2) [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Madison Square Garden Sports breach record advisory · Have I Been Pwned · Jun 24, 2026 ### How Hackers Broke into Madison Square Garden news · 404 Media · Jun 24, 2026 ### Hackers Publish Knicks and Madison Square Garden Data Online news · 404 Media · Jun 16, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 90% confidence · current** June 2026 Madison Square Garden Sports data breach: 404 Media reported that a low-level employee was called and tricked into allowing access to MSG systems. 2. **Attributed To · 90% confidence · current** June 2026 Madison Square Garden Sports data breach: ShinyHunters 3. **Resulted In · 100% confidence · current** June 2026 Madison Square Garden Sports data breach: 404 Media directly observed that Madison Square Garden data had been published online for public download. 4. **Occurred At · 80% confidence · current** June 2026 Madison Square Garden Sports data breach: 2026-06-05 5. **Exposed Data Category · 100% confidence · current** Madison Square Garden Sports published data corpus: Names 6. **Resulted In · 100% confidence · current** Madison Square Garden Sports published data corpus: The sample reviewed by 404 Media contained files mentioning specific sports teams and Knicks-related personalities, including address, claim-to-fame, talent-cost, and some contact fields. 7. **Resulted In · 95% confidence · current** June 2026 Madison Square Garden Sports data breach: Madison Square Garden Sports published data corpus 8. **Resulted In · 100% confidence · current** Madison Square Garden Sports published data corpus: 404 Media reported that the published data included emails between customers and Madison Square Garden. 9. **Exposed Data Category · 100% confidence · current** Madison Square Garden Sports published data corpus: Customer service records 10. **Exposed Data Category · 100% confidence · current** Madison Square Garden Sports published data corpus: Contact information 11. **Disclosed At · 100% confidence · current** June 2026 Madison Square Garden Sports data breach: 2026-06-16 12. **Affected Organization · 95% confidence · current** June 2026 Madison Square Garden Sports data breach: Madison Square Garden Sports Corp. 13. **Exposed Record Count · 100% confidence · current** Madison Square Garden Sports published data corpus: 9,796,738 record 14. **Affected Organization · 90% confidence · current** June 2026 Madison Square Garden Sports data breach: New York Knicks 15. **Disclosed At · 100% confidence · current** June 2026 Madison Square Garden Sports data breach: 2026-06-24