Madison Square Garden Sports Exposes Nearly 10 Million Customer and Staff Records in ShinyHunters Extortion Breach
What Happened — In June 2026, the ShinyHunters extortion group targeted Madison Square Garden Sports (msgsports.com). After a “pay‑or‑leak” demand, the group published a data set containing 9,796,738 unique records – email addresses, names, phone numbers, physical addresses and internal customer‑service details for both staff and patrons.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous third‑party risk‑management program is built to detect, document, and remediate – a vendor‑related data exposure that must be tracked for audit evidence.
- Demonstrable oversight of external partners (e.g., regular security assessments, contractual security clauses, and real‑time monitoring) provides the defensible control evidence that frameworks such as NIST CSF 2.0 expect for supply‑chain risk.
- Leveraging a unified Trust Center lets organizations capture breach‑response evidence, map it to the relevant control objective, and maintain a continuous audit trail.
Who Is Affected — Sports & entertainment organizations, their employees, ticket‑buyers, and any third‑party services that interact with MSG Sports’ customer‑service platform.
Recommended Actions
- Initiate a formal third‑party risk review of the MSG Sports engagement – verify security posture, contractual safeguards, and recent assessment results.
- Collect and preserve all incident‑related artifacts (logs, communications, data samples) to build a defensible audit trail.
- Update your data‑handling controls (encryption at rest, least‑privilege access, regular monitoring) and ensure they are continuously monitored in a Trust Center.
- Notify affected individuals per applicable privacy regulations and document the response for compliance reporting.
Source: [Have I Been Pwned – MSG Sports Breach]
Technical Notes
- Data exposed: customer‑service records, email addresses, names, phone numbers, physical addresses.
- Attack vector: extortion after an undisclosed initial compromise (publicly reported as “pay‑or‑leak”). No specific CVE or vulnerability disclosed.
- Threat actor: ShinyHunters, known for “pay‑or‑leak” campaigns.
Source: [HIBP breach detail]