Summary
The ShinyHunters extortion group has claimed responsibility for breaching Madison Square Garden (MSG), exfiltrating 45 GB of corporate and customer data including 26 million customer records, customer support email archives, and internal human resources files. The group has posted samples on its dark web leak site and is reportedly demanding ransom payment to prevent a full public release.
The breach exposes a massive trove of customer PII from one of the most iconic entertainment venues in the world. MSG’s properties include Madison Square Garden, Radio City Music Hall, the Beacon Theatre, and the Chicago Theatre, along with the New York Knicks and New York Rangers professional sports franchises. The scope of the data theft suggests deep access to MSG’s internal systems and customer-facing platforms.
This attack comes on the heels of ShinyHunters’ recent breaches of Kodak and the National Association of Insurance Commissioners (NAIC), where they stole over 3.1 terabytes of regulatory filing data. The group continues its relentless 2026 campaign targeting high-profile organizations across industries.
Source
Security Boulevard — MSG Breach: ShinyHunters Takes the Data
Commentary
ShinyHunters is operating at an industrial scale in 2026, and the MSG breach may be their most high-profile hit yet. Twenty-six million customer records from a brand synonymous with American entertainment and sports is the kind of breach that draws regulatory scrutiny and class-action lawsuits. The inclusion of internal HR data adds an employee exposure dimension on top of the customer impact.
What’s striking is the pace. Between Kodak, NAIC, the Oracle PeopleSoft university attacks, and now MSG, ShinyHunters is burning through major targets at a rate that suggests either a large team, highly effective automation, or both. Organizations should be actively threat-hunting for ShinyHunters TTPs and auditing their external-facing platform configurations — especially SaaS integrations and cloud storage.