--- title: "Madison Square Garden family Oracle E-Business Suite data incident" description: "The MSG family reported an August 2025 compromise of vendor-hosted Oracle software containing workforce and payment records." incident_type: "Data incident" status: "active" last_modified: "2026-10-19" canonical_url: "https://www.ally.security/incidents/msg-family-oracle-ebs-data-incident-2025" markdown_url: "https://www.ally.security/incidents/msg-family-oracle-ebs-data-incident-2025.md" stix_url: "https://www.ally.security/incidents/msg-family-oracle-ebs-data-incident-2025/stix.json" --- # Madison Square Garden family Oracle E-Business Suite data incident This Oracle E-Business Suite incident is separate from the June 2026 MSG customer-data publication. Last modified Oct 19, 2026 · 2 sources ## Summary - **Environment:** Vendor-hosted Oracle E-Business Suite workforce and finance systems - **Operational impact:** Hiring or payment records accessed, including names and Social Security numbers - **Financial impact:** MSG Sports said the incident was not material to its business or results ## What happened The Madison Square Garden family’s [February 23, 2026 notice](https://oag.ca.gov/system/files/MSG%20-%20California%20Notification.pdf) says an intruder accessed vendor-hosted Oracle eBusiness Suite data in August 2025. The notice names [MSG Sports](https://www.msgsports.com/), [MSG Entertainment](https://www.msgentertainment.com/) and Sphere Entertainment. [2](#source-2) ## Impact Affected hiring or payment records included names and Social Security numbers. Investigation established access in late November 2025; the affected-file review identified personal information in December. No total affected population is established here. [2](#source-2) The [Spinco filing](https://www.sec.gov/Archives/edgar/data/2132873/000119312526402509/d127770dex991.htm) says MSG Sports’ own network was not involved and the incident was not material to its business or results. [1](#source-1) ## Timeline ### February 23, 2026 — Group issues breach notice The notification sample describes the incident and monitoring offer. [2](#source-2) ### October 19, 2026 — Briefing updated This briefing was last reviewed and updated on October 19, 2026. ## Threat Group & Attack Vector The notice attributes access to exploitation of a previously undisclosed condition in Oracle’s application. It names no CVE or attacker. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The group confirmed vendor implementation of Oracle-recommended measures, notified law enforcement and offered one year of credit monitoring. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### MSGS Spinco information statement — Oracle E-Business Suite incident official · MSGS Spinco, Inc. ### Madison Square Garden Family of Companies — Oracle eBusiness Suite breach notice official · Madison Square Garden Family of Companies · Feb 23, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: The Spinco filing says the Oracle instance was hosted on a third-party-managed server, MSG Sports’ network was not involved, and MSG Sports assessed the breach as not material to its business and results. 2. **Occurred At · 100% confidence · current** Group issues breach notice: 2026-02-23 3. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: The investigation determined the unauthorized access in late November 2025; the group identified an affected file containing a name and Social Security number in December. 4. **Exposed Data Category · 100% confidence · current** Hiring and payment records in the Oracle application: Names 5. **Affected Organization · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: Madison Square Garden Sports Corp. 6. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: Group issues breach notice 7. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: The notice attributes access to exploitation of a previously undisclosed condition in the Oracle application, without identifying a CVE. 8. **Affected Organization · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: Sphere Entertainment Co. 9. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: The group confirmed its vendor implemented Oracle-recommended measures, notified law enforcement, and offered one year of credit monitoring to notice recipients. 10. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: Hiring and payment records in the Oracle application 11. **Affected Organization · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: Madison Square Garden Entertainment Corp. 12. **Exposed Data Category · 100% confidence · current** Hiring and payment records in the Oracle application: Social Security numbers 13. **Resulted In · 100% confidence · current** MSG family vendor-hosted Oracle E-Business Suite compromise: The group’s vendor-hosted Oracle eBusiness Suite supported workforce and financial operations. An unauthorized person accessed application data in August 2025.