HackingOtherVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDownstream VictimsDelayed DiscoveryPIIIDENTITY_GOVERNMENTMediumContained
The Madison Square Garden Family of Companies (Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.)
bd_eaa3e48a101e2936 · schema v1 · pii pii-v1
Full breach record for The Madison Square Garden Family of Companies (Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.) →MSG Entertainment Corp. reported a breach affecting 11 Maine residents. An unauthorized actor exploited a previously undisclosed vulnerability in Oracle eBusiness Suite hosted by a third-party vendor, gaining access to names and Social Security numbers in August 2025. Investigation concluded November 2025; Maine residents identified December 2025. Notifications sent February 26, 2026. Vendor implemented Oracle-recommended fixes. One-year credit monitoring offered.
Maine clockDiscovered Dec 16, 2025 → Filed with AG Feb 26, 202672d ⏱ ME AG >30d10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 97 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_66b8b6b5e23d3e10Leak Sitecl0pfiled 2025-11-21(97d gap)Verified
Regulatory filings (1) · sorted by filing gap
- bd_e7bdd410442df1aeCalifornia State AGfiled 2026-02-23(3d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/44a0bea6-9a88-49c9-81ed-3b6f388f9f8b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 26, 2026
- Raw hash
- 2143b128c8b41a17f93b58ccc5f90c043c41868399f8b8640b7e994b19930191
Reporting entity
- Name
- The Madison Square Garden Family of Companies (Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.)norm: the madison square garden family of companies madison square garden sports corp madison square garden entertainment corp and sphere entertainment
- Domain
- msg.com
- Industry
- Entertainment
Victim entity
- Name
- The Madison Square Garden Family of Companies (Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.)norm: the madison square garden family of companies madison square garden sports corp madison square garden entertainment corp and sphere entertainment
- Domain
- msg.com
- Industry
- Entertainment
- Industry
- Otherllm
Incident
- Discovered
- Dec 16, 2025
- Materiality determined
- Dec 16, 2025
- Notification sent
- Feb 26, 2026
- Affected individuals
- 11
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 10 weeks(72 days from discovery to filing)
- Compliance flags
- ME AG >30d · 72dME resident >60d · 72dLeak >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 16, 2025→ Filed with AG: Feb 26, 202672d 30 days (soft) ME AG >30d Maine Discovered: Dec 16, 2025→ Notified: Feb 26, 202672d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.