Law Firm Probes MSG Entertainment Data Breach

The breach was first discovered by Madison Square Garden Entertainment on or about December 16, 2025. However, an investigation revealed that an unauthorized party first gained access to the application data back in August 2025. The vulnerability was not in MSG's primary systems, but in a third-party vendor's hosted Oracle eBusiness Suite. This highlights the growing risk of supply chain attacks, where attackers target a company's less secure partners to gain access to their data. The compromised files may have contained highly sensitive personal information, including full names, addresses, and even Social Security numbers. MSG Entertainment has started the process of sending out notification letters to all customers who may have been affected by the breach. This is not the first major data security issue for the entertainment giant. In 2016, MSG revealed that malware had been active on its payment processing systems for nearly a year, capturing credit card data from customers who purchased merchandise, food, and beverages at several of its venues. That earlier breach affected payment cards used at Madison Square Garden, the Theater at MSG, Radio City Music Hall, Beacon Theater, and the Chicago Theater. The data stolen included card numbers, cardholder names, expiration dates, and internal verification codes. The current investigation by Edelson Lechtzin LLP, a national class action law firm, is exploring the legal remedies available to individuals whose data may have been compromised in this latest incident. MSG Entertainment has also faced scrutiny over its use of other customer data, specifically its use of facial recognition technology. The company has been criticized and sued for its practice of identifying and ejecting perceived legal adversaries from its venues.