MSG Data Breach May Have Exposed Your Face Scan, Social Security Number, and More

Madison Square Garden Entertainment has been using facial recognition technology to scan the faces of everyone who walks through the doors of its venues — including the famous arena in New York City, Radio City Music Hall, the Beacon Theatre, and others. That data was stored in its systems. And in June 2026, a criminal hacking group got to it.

The hackers, a group known as ShinyHunters, published 45 gigabytes of internal MSG files after the company missed a ransom deadline on June 15, 2026. Within days, five separate class action complaints were filed in federal court in New York by people who say their private information was taken and exposed without their consent.

What Information Was Exposed?

According to the lawsuits and published reports, the breach exposed an unusually sensitive combination of personal data:

• Biometric facial recognition data — a digital scan of your face, mapped and stored as a unique identifier
• Social Security numbers
• Credit scores and financial information
• Background check records
• Names, addresses, and other personal details

As many as 26 million people are believed to be affected. That estimate comes from the data the hackers published online after MSG failed to pay the ransom.

Why Is Biometric Data Different?

Most data breaches expose information that is bad but fixable. If your credit card number is stolen, you can get a new card. If your email password is taken, you can reset it.

Your face cannot be reset. Biometric data — including facial recognition scans — is a permanent part of who you are. Once it is out in the world, it can be used in ways that are very hard to defend against, including creating fake identities or bypassing security systems that rely on facial recognition.

This is why laws in several states specifically protect biometric data, and why courts take these breaches seriously.

What Did MSG Do — and What Went Wrong?

MSG has been using facial recognition at its venues for years, sparking controversy long before this breach. The company used the technology not only for general security but to identify and turn away attorneys involved in lawsuits against MSG — a practice that drew significant attention and criticism.

The hackers who carried out this breach, ShinyHunters, are a well-known criminal group responsible for multiple high-profile data theft incidents. According to the lawsuits, MSG’s security systems failed to protect the enormous amount of personal data it had collected from visitors, including the biometric information gathered at its doors.

This was also not MSG’s first breach. In early 2026, a separate hacker group had already exploited a different vulnerability in MSG’s systems, exposing data on more than 130,000 people.

Who Is Filing These Lawsuits?

Five class action complaints were filed in federal court in New York between June 16 and June 18, 2026. The first was filed by a man who attended a concert at MSG in September 2025 and says his personal information was collected and then exposed without adequate protection. Four additional complaints followed over the next two days.

The lawsuits accuse MSG of collecting visitors’ data without properly protecting it, failing to put adequate safeguards in place, and not doing enough to prevent the kind of breach that occurred.

Do You Have a Claim?

You may have options if you attended any event at an MSG venue and your personal information may have been exposed. You do not need to have received a notice letter from MSG, and you do not need to have suffered a specific financial loss yet to speak with an attorney about your situation.

• You attended a Knicks, Rangers, or other event at Madison Square Garden in New York City
• You attended a show at Radio City Music Hall, the Beacon Theatre, or another MSG-owned venue
• You have concerns about your biometric data, Social Security number, or other personal information

Common Questions