Summary
- Environment: Vendor-hosted Oracle E-Business Suite workforce and finance systems
- Operational impact: Hiring or payment records accessed, including names and Social Security numbers
- Financial impact: MSG Sports said the incident was not material to its business or results
- Record status: Developing record. Reviewed October 19, 2026; updated as evidence emerges.
What happened
The Madison Square Garden family’s February 23, 2026 notice says an intruder accessed vendor-hosted Oracle eBusiness Suite data in August 2025. The notice names MSG Sports, MSG Entertainment and Sphere Entertainment. [2]
Impact
Affected hiring or payment records included names and Social Security numbers. Investigation established access in late November 2025; the affected-file review identified personal information in December. No total affected population is established here. [2]
The Spinco filing says MSG Sports’ own network was not involved and the incident was not material to its business or results. [1]
Timeline
Group issues breach notice
The notification sample describes the incident and monitoring offer.
[2]Briefing updated
This briefing was last reviewed and updated on October 19, 2026.
Threat Group & Attack Vector
The notice attributes access to exploitation of a previously undisclosed condition in Oracle’s application. It names no CVE or attacker. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The group confirmed vendor implementation of Oracle-recommended measures, notified law enforcement and offered one year of credit monitoring. [2]