Madison Square Garden Sports msgsports.com Madison Square Garden Sports data breach: what happened and what to do
In June 2026, Madison Square Garden Sports was hit by a ShinyHunters extortion campaign, and the group published the data. Have I Been Pwned counts 9.8 million email addresses, with names, phone numbers, physical addresses and customer service records.
View all 13,115 breaches- Breach date
- 5 Jun 2026
- Affected
- 9,796,738
- Data exposed
- Customer service records, Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Madison Square Garden Sports owns the Knicks and Rangers and is tied to the Garden arena. In June 2026 the ShinyHunters group ran a "pay or leak" campaign against it. Reports say the group threatened the company on June 12 with a deadline of June 15, then published the data on June 16 after no deal was reached.
404 Media covered the leak, which spanned staff and customers. Coverage in late June said the company had not issued a public statement. Several class action lawsuits have since been filed, and one alleges the company has not notified the people affected.
How many people
Have I Been Pwned counted 9,796,738 unique email addresses in the published data, so about 9.8 million. Some outlets cite far larger record counts for the archive as a whole, but the email count is the figure Have I Been Pwned verified.
What was exposed
Have I Been Pwned lists names, email addresses, phone numbers, physical addresses and customer service records. Its description adds that the data included extensive personal, employment and customer relationship information for both staff and customers.
Reports on the leak mention more than that. Some describe dates of birth, and Bloomberg Law reported that the archive also contained threat assessment data collected on visitors. Those details come from press coverage, not from Have I Been Pwned's list, so check them against anything the company sends you.
What that lets criminals do
A name, email, phone number and home address together are the raw material for targeted phishing. A scammer can write to you as a ticket seller, a box office or an arena, and reference real details about you. Phone numbers also open the door to text scams and to SIM swap attempts, where someone convinces your carrier to move your number to their phone so they can intercept login codes.
Customer service records can contain what you asked about, what you bought and when. That context makes a fake refund or "ticket problem" message much more believable.
The company's response
Coverage in late June reported that Madison Square Garden Sports had not publicly addressed the breach. No company notice or offer of credit monitoring has been published. If the company does publish a notice or send letters, trust those over press summaries.
If you bought tickets or worked there
The leak spans staff and customers, so anyone who has bought tickets, joined a mailing list or worked for the company since the data was taken could be in it. Search your email on Have I Been Pwned, and check any addresses you used for ticketing.
What to do if you were in it
- 1
Expect ticket and refund scams
Messages that mention Knicks, Rangers or the Garden, a ticket problem or a refund are likely. Don't click links in them. Go to the official site or app instead.
- 2
Protect your phone number
Ask your carrier to add a port-out PIN or number lock, so nobody can move your number to another SIM. Use an authenticator app instead of text codes where you can.
- 3
Be cautious about calls and texts
Your phone number and address leaked. Don't give out verification codes or card details to anyone who contacts you first.
- 4
Watch for the company's own notice
If you get a letter or email from the company, read it directly and use only the contact details in it, not those from a forwarded message.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears. It can't take data out of a breach, but it shows you what leaked and what to do about it.
Frequently asked
Was I affected by the Madison Square Garden Sports breach?
You may be if you bought tickets, signed up for emails or worked for the company. Search your email on Have I Been Pwned, which holds 9.8 million email addresses from the published data.
What was exposed?
Have I Been Pwned lists customer service records, email addresses, names, phone numbers and physical addresses. Press reports describe more, including dates of birth, but those details are not in Have I Been Pwned's list.
Is there a settlement?
None has been reported. Several class action lawsuits have been filed over the breach, but no settlement is reported.
Should I change my password?
Passwords are not listed in the exposed data. Changing a password that you reuse across sites is still sensible, and so is turning on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
