HackingVulnerability ExploitSupply Chain (3P Vendor)TargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
The Madison Square Garden Company
bd_39f83d65f30204f1 · schema v1 · pii pii-v1
Full breach record for The Madison Square Garden Company →The Madison Square Garden Family of Companies notified consumers of a data breach involving Oracle eBusiness Suite. An unauthorized party exploited a vulnerability in the application, hosted by a vendor, to access workforce and financial data including names and Social Security numbers starting in August 2025. The incident was discovered in November 2025. Affected individuals were offered one year of credit monitoring.
Vermont clock✗ VT AG >45 bday17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-02-26-madison-square-garden-entertainment-corp-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 26, 2026
- Raw hash
- d38456e4e9fd9820cea426e524ce5f019fe44112bd9f676ea8b6bcfee35ec4f7
Reporting entity
- Name
- The Madison Square Garden Companynorm: the madison square garden
Victim entity
- Name
- The Madison Square Garden Companynorm: the madison square garden
Incident
- Discovered
- Nov 1, 2025
- Materiality determined
- Feb 23, 2026
- Notification sent
- Feb 23, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 weeks(117 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.