Loading story…
ShinyHunters allegedly breached Madison Square Garden Entertainment by socially engineering a low-level employee over the phone and stealing Microsoft Entra credentials, then published a 45GB archive after a failed "pay or leak" extortion attempt. Reporting says the intrusion exposed data tied to Madison Square Garden, Radio City Music Hall, the Beacon Theatre, and the Sphere in Las Vegas, with the dumped records including customer and support data, internal corporate and talent files, and other sensitive operational information.
The leaked dataset reportedly affected about 9.8 million unique email addresses and included nearly 5 million street addresses with names and phone numbers, roughly 9,500 dates of birth, and additional employment and customer relationship records. Multiple reports also say the breach exposed highly sensitive surveillance and biometric information, including facial-recognition-related records, celebrity threat profiles, activist dossiers, and internal watchlist data, prompting class action lawsuits and renewed scrutiny of MSG's identity security and facial recognition practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The breach triggered multiple class action lawsuits, including at least one alleging that biometric data from concertgoers was exposed. The legal actions also intensified scrutiny of MSG's facial-recognition and surveillance practices.
In June 2026, Madison Square Garden Sports was targeted in a ShinyHunters 'pay or leak' extortion campaign following the intrusion. The campaign affected staff and customers and involved allegedly stolen corporate and customer data.
On June 16, 2026, the threat actor published a 45GB archive of allegedly stolen MSG data after the extortion attempt. Reports say the leak exposed roughly 9.8 million email addresses and extensive customer, employment, surveillance, and biometric-related records.
On June 12, 2026, ShinyHunters reportedly announced it had stolen Madison Square Garden company data and threatened to release more than 26 million records unless a ransom was paid. The announcement marked the public start of the group's pay-or-leak pressure campaign against MSG.
ShinyHunters allegedly compromised Madison Square Garden Entertainment on June 5, 2026 by socially engineering a low-level employee over the phone and stealing Microsoft Entra credentials. Reporting says the intrusion relied on human deception rather than a disclosed software exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceteiss.co.uk
Open sourcethecybersecguru.com
Open sourcesecuritymagazine.com
Open sourcemalware.news
Open sourcehaveibeenpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Figure Technology Solutions**, a blockchain-based lending/fintech firm, confirmed a **data breach** after an employee was **socially engineered**, enabling attackers to access and exfiltrate a **limited number of files**. The company said it is communicating with partners and impacted individuals, has begun sending notifications, and is offering **free credit monitoring** to recipients of breach notices; it has not publicly disclosed the total number of affected individuals or when the incident was detected. The cybercrime group **ShinyHunters** claimed responsibility and alleged Figure refused to pay a ransom, publishing about **2.5GB** of purportedly stolen data on its leak site. Journalists who reviewed samples reported the exposed data included **names, home addresses, dates of birth, and phone numbers**, increasing risk of identity fraud and follow-on phishing. ShinyHunters also told reporters the intrusion was part of a broader campaign affecting organizations including **Harvard University** and **UPenn**, and referenced victims that rely on **Okta** for single sign-on.
Jun 29, 2026
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026
**ShinyHunters** is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace **CarGurus** in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included **12M+ email addresses** across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes). ShinyHunters also claimed to have stolen **800,000+ records** from **Wynn Resorts** and demanded **22.34 Bitcoin (~$1.5M)** to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including **Social Security numbers**, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in **September 2025** via an **Oracle PeopleSoft vulnerability** combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.
Jun 29, 2026