Madison Square Garden Sports data breach: 9.8M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-06-24
In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign. The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information. Exposed data: customer service records, email addresses, names, phone numbers, physical addresses. The breach dates from Jun 5, 2026; Have I Been Pwned loaded it on Jun 24, 2026.
What to do
- If you had a Madison Square Garden Sports account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch