Madison Square Garden Entertainment data breach: hiring and payment records in Oracle E-Business Suite

Date	Event
August 2025	An unauthorized person takes data from the Oracle E-Business Suite instance a vendor runs for MSG
Late November 2025	The vendor's investigation, with a forensic firm, confirms the access
December 2025	MSG finds a file with names and Social Security numbers among the records taken
February 23, 2026	Letters
February 26, 2026	Reports to Massachusetts (169 residents) and Vermont

What happened at Madison Square Garden Entertainment?

MSG was one of the organizations hit through Oracle E-Business Suite in 2025. Its letter says Oracle told customers that an attacker had exploited a previously undisclosed condition in the application to get data out of it. The letter notes reports that the same thing happened at over 100 companies.

MSG did not run the application itself. The letter says a vendor hosts and manages the E-Business Suite for MSG, and that it is used for certain workforce and financial operations. The vendor led the investigation and brought in a forensic firm. The letter does not name the vendor.

The Oracle E-Business Suite guide lists the other organizations whose notices this site has read. Most of them, like MSG, date the access to August 2025 and sent letters months later.

Who got a letter from MSG Entertainment?

People whose details were in hiring records or payment records in the application. The letter describes the files as business records related to hiring or to payments made to individuals. The letter does not say whether those people are employees, job applicants or others the company paid. The guide to letters from a company you never dealt with covers how that happens.

The letters went out in the name of "The Madison Square Garden Family of Companies". The Massachusetts and Vermont records list the reporting organization as Madison Square Garden Entertainment Corp.

What information was exposed?

Name and Social Security number. Massachusetts marks Social Security numbers only, with no medical, financial account, driver's license or card data.

Record	People	Data it marks
Massachusetts OCABR, report 2026-292 (February 26, 2026)	169	SSNs
Vermont AG, notice to consumers (posted February 26, 2026)	Not given in the letter	Name and SSN

What did MSG do?

The letter says MSG confirmed that its vendor applied the fixes Oracle recommended for the application, to prevent it happening again. MSG also notified law enforcement. People who got a letter are offered one year of credit monitoring, a credit report and a credit score through Cyberscout, a TransUnion company. They must enroll within 90 days of the letter's date. For a letter dated February 23, 2026, that window closed in late May 2026. The assistance line is 844-784-8179 on weekdays. For how this offer compares with others, see the credit monitoring guide.

Why did the letters take six months?

The timeline in the letter explains most of it. The theft happened in August 2025, but the vendor's investigation did not confirm it until late November. MSG then needed until December to find the file with Social Security numbers. Letters followed in February 2026. The notice letter delay guide compares gaps like this one.

What the documents leave open

• The total number of people notified across all states.
• Which vendor hosted the application.
• Whether the data has been published or offered for sale.