ShinyHunters Exposes Massive MSG Data and Internal Risk Ratings

Madison Square Garden and the New York Knicks are facing scrutiny after the hacking group ShinyHunters published nearly 45GB of allegedly stolen company data online. The release followed what appears to have been a failed extortion attempt, with the group claiming MSG did not pay a ransom demand before a deadline set by the attackers.

Publication of the data came just days after the Knicks won the NBA Finals, placing additional attention on an organization already dealing with the aftermath of a separate cybersecurity incident disclosed earlier this year.

Journalists who reviewed portions of the data reported finding customer correspondence, internal records, and files connected to athletes, celebrities, executives, and their representatives.

The hackers also posted a message alongside the release stating that organizations that refuse to pay can expect their stolen data to be published.

Why It Matters: Among the more notable details in the leak are records that appear to go beyond basic contact information and operational data. Files reportedly included internal risk designations, talent valuations, and other information tied to how the organization tracked and managed relationships with prominent individuals. Once exposed, those records can draw scrutiny because they reveal internal assessments, categorization practices, and relationship-management processes that are rarely visible outside the organization.

• Ransom Dispute Goes Public: ShinyHunters published nearly 45GB of files and posted a message stating that organizations that refuse to pay are exposed publicly. A spokesperson for the group said the intrusion occurred on June 5. The publication happened shortly after the Knicks’ championship victory, placing the leak under a much brighter spotlight than it might have otherwise received.

• Customer Emails Surface: The sample provided to journalists included emails exchanged between customers and MSG. One message involved concerns about whether a customer had been flagged by the company’s facial-recognition systems. MSG’s use of facial-recognition technology has been the subject of public scrutiny and media coverage in recent years.

• Talent Database Exposed: One of the more notable files contained records tied to former Knicks players, former coaches, celebrities, and family members of MSG executives. Reported fields included addresses, contact details, appearance fees, representative information, and biographical notes. For example, Ben Stiller was included in the file through contact information associated with Red Hour Films, his production company.

• Internal Risk Labels Revealed: The database reportedly categorized individuals using labels such as “Low Risk” and “High Risk.” Ben Stiller appeared in the former category, while rapper A Boogie wit da Hoodie was listed as the only “High Risk” individual in the reviewed sample. The records did not include documentation explaining how those classifications were determined, leaving the purpose and methodology behind the ratings unclear.

• Separate Breach, New Attackers: In March, MSG confirmed a breach involving Oracle’s E-Business Suite environment. Reporting tied that incident to the Cl0p ransomware group, which later identified MSG as a victim. The newly published data appears connected to ShinyHunters instead. The incidents involved different threat actors and different systems, suggesting separate compromises. At the time of reporting, MSG had not publicly responded to requests for comment regarding the newly released data.

Go Deeper -> Hackers Publish Knicks and Madison Square Garden Data Online – 404 Media

Hackers Just Published Knicks and Madison Square Garden Data – Gadget Review