MSG sued after facial recognition data breach exposes 26 million visitors
Madison Square Garden faces a class action lawsuit after hackers breached its systems and accessed biometric facial recognition data, background checks, credit scores and Social Security numbers for up to 26 million visitors. The cybercrime group ShinyHunters claimed the hack and demanded ransom before publishing over 42 gigabytes of information online.
What happened
Cybercrime group ShinyHunters claimed to have breached MSG Entertainment's internal systems to obtain biometric facial recognition data, background check information, credit scores and Social Security numbers from up to 26 million people who visited Madison Square Garden.
ShinyHunters demanded ransom payment from MSG Entertainment to avoid releasing the information, but subsequently published over 42 gigabytes of data online.
A class action lawsuit was filed Tuesday in New York federal court on behalf of plaintiff Carlos Avalo, who attended a concert at MSG in September 2025 and claims his personal identifying information was collected and included in the breach.
Reported impact
Examples of exposed information include visitor risk assessments, such as actor Ben Stiller being categorized as 'low risk' and rapper A Boogie wit da Hoodie being categorized as 'high risk' by MSG systems.
Index analysis
The suit alleges that MSG Entertainment has a 'tempestuous history with respect to data privacy' and notes that despite previous lawsuits and concerns from privacy advocates and New York legislators, the arena continues to collect biometric information under the direction of owner James Dolan.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.