Forgot your password?
typodupeerror

Submission + - ShinyHunters Published 45GB of Madison Square Garden Facial Recognition Records (thenextweb.com)

ArchieBunker writes: The cybercrime group ShinyHunters has published 45 gigabytes of data stolen from Madison Square Garden Entertainment after the company missed a June 15 ransom deadline. The dump includes facial recognition surveillance records, internal threat assessments, and personal information from what the hackers claim are 26 million customer and corporate records. A federal class action lawsuit was filed the following day.

The breach occurred on June 5, according to a ShinyHunters spokesperson who spoke to 404 Media. The data was published on June 16, days after the New York Knicks won the NBA Finals in five games against the Spurs, putting intense public attention on the arena and its owner, James Dolan.

What makes this breach unusual is the nature of the surveillance data it exposed. MSG has deployed facial recognition technology across its venues for years, using the system to screen visitors and, controversially, to ban lawyers from firms that have sued the company. The leaked files include biometric tracking logs, background check information, internal threat assessments, and what the class action complaint describes as detailed dossiers on attendees.

A sample reviewed by 404 Media contained files specifically referencing Knicks-related personalities, with fields including “address,” “claim to fame,” “cost of talent,” and direct contact information for individuals or their representatives. The data also included internal risk tags classifying celebrities: actor Ben Stiller was profiled as “low risk,” while rapper A Boogie wit da Hoodie was flagged as “high risk,” according to the class action filing. No documented criteria explaining the labels were included in the leaked files.

Customer emails were also part of the dump, including messages from fans who had expressed concern about being misidentified by MSG’s facial recognition cameras. The inclusion of this correspondence reveals that MSG was collecting and storing complaints about its own surveillance practices alongside the biometric data itself.

A class action lawsuit, Avalo v MSG Entertainment, was filed on June 16 in New York federal court. The plaintiff, Carlos Avalo, attended a concert at MSG in September 2025 and alleges his biometric data was captured by the venue’s entry systems. The lawsuit seeks at least $5 million in initial damages.

The complaint accuses MSG of corporate negligence in failing to secure the data it aggressively collects, despite clear warnings from privacy advocates and a previous breach.

This is MSG’s second major breach in under a year. In a separate incident disclosed in February 2026, the Cl0p ransomware group exploited a vulnerability in a vendor-hosted Oracle eBusiness Suite application used by MSG for payroll and human resources. That intrusion began in August 2025 but went undetected until December 16, 2025, and exposed the names, addresses, and Social Security numbers of roughly 131,070 individuals, primarily employees and contractors.

ShinyHunters has been on a sustained campaign in 2026, exploiting an unpatched Oracle PeopleSoft zero-day to breach more than 100 organisations, two-thirds of them universities. The group previously orchestrated the 2024 Snowflake supply chain attacks that compromised Ticketmaster and AT&T, and in March 2026 breached the European Commission, leaking 350 gigabytes of data from 42 internal clients.

The MSG attack follows the same playbook ShinyHunters used against Instructure’s Canvas learning management system in April, where the group claimed 3.65 terabytes of data from 275 million users across 9,000 schools. The pattern is consistent: identify a target sitting on large volumes of sensitive data, exfiltrate it, set a ransom deadline, and publish when the deadline passes.

MSG Entertainment has not publicly confirmed the scope of the breach or commented on the class action. The company’s facial recognition programme has faced scrutiny since at least 2022, when it drew attention for using the technology to bar attorneys from firms involved in litigation against the company. The New York attorney general investigated, and a state court initially ruled the policy violated anti-discrimination law, though an appeals court later reversed that decision.

The breach raises a question that extends beyond MSG: organisations that invest heavily in surveillance technology to monitor their visitors are creating precisely the kind of high-value data troves that groups like ShinyHunters target. The 26 million figure cited by the hackers has not been independently verified, and the full scope of the exposed biometric data remains unclear as the investigation continues.

Comment Re: Cool Cool (Score 1) 72

Do you honestly believe that mass debt forgiveness -- after COVID was already over! -- was a necessary emergency response to the pandemic? Suspending payments (and interest) during the pandemic made perfect sense, and that was not struck down. I don't recall that it was even challenged.

No, the debt forgiveness clearly had nothing to do with the (already-ended) emergency, it was just an attempt to skirt the law, and the courts were quite correct to strike it down as executive overreach. If Biden wanted to do that, he should have lobbied Congress to change the law. He didn't do that, of course, because he knew Congress would refuse -- even though his party held both houses.

Comment Re:Cool Cool (Score 1) 72

Your comment mischaracterizes what has happened. The Supreme Court has absolutely bent over backwards to let Trump do what he wants in temporary rulings, including jumping in to to stay lower-court orders that no previous court would even have responded to. But their on-the-merits rulings, when they have to issue a full opinion, have been much less friendly to Trump. There have been some incredibly bad ones (e.g. immunity) but Trump has lost more than he has won in SCOTUS final judgements.

Comment Re:who will do hard time hitting a worker can be c (Score 1) 53

who will do hard time hitting a worker can be charged as a felony under the state’s “endangerment of a highway worker” or “aggravated endangerment of a highway worker”

You're treating the current law as a standard handed down from on high, incontrovertible and guaranteed-correct, which must be applied verbatim. And, indeed, laws must be applied as written... but that doesn't mean the laws are perfect forever. Laws are written within a context, and when the context changes, the laws have to change.

In a world where all cars are driven by humans, if you want to protect highway workers one way to do it is to attach serious prison time to killing one and to publicize that fact loudly so that all of the drivers know that they should be especially cautious around highway workers, even more than they would around other sorts of pedestrians (let's put aside the moral debate about whether we actually should protect highway workers more than other pedestrians).

In a world where some cars are driven by software systems, that strategy doesn't really work -- as your question correctly points out -- but the right conclusion isn't "Therefore self-driving cars shouldn't be allowed", or "Therefore we must identify some scapegoat human at the company to put in prison". The right conclusion is "Therefore we need a different kind of regulation to keep highway workers safe from self-driving cars". What should that be? I can think of lots of possibilities, both pro-active (e.g. require self-driving vehicles to demonstrate in rigorous testing that their vehicles stay far from highway workers, with whatever minimum distance you want to specify) and reactive (severe penalties, up to heavy fines and/or immediate loss of permission to operate). The point is that the law should choose an approach that works with the new context.

Comment Re:The standard pro self-driving argument (Score 2) 53

So, for example, if self-driving cars today drive 10% better than the average driver, this also means that they all drive worse than 40% of human drivers out there.

And? They still drive 10% better than the average driver. And I realize that number is just an example, not intended to be accurate, but I still feel like I should point out that, statistically, it's too low.

The fact that the self-driving cars will all concentrate their worst behaviors in the same regions of the space of all driving conditions doesn't change the fact that, on average, they're quite a bit safer than human drivers. This wouldn't be true if the roads somehow changed so that the problematic-for-self-driving scenarios predominated, but they don't.

I considers these vehicules, in their current state to be too dangerous to be on public roads.

So you consider most human drivers too dangerous to be on public roads.

But I'm sure the usual binary-thinking simpletons will simply put me in their little "against" box anyway

You're taking a binary position (too dangerous to be on public roads), so you should expect people to evaluate your position in a binary way. Your other position, trying to position Waymo safety within the wide continuum of driver safety, is more nuanced.

My position is that if they're statistically safer than average human drivers, which makes them far safer than the worst human drivers on the road, then replacing human-driven cars with self-driving cars makes the roads safer. This is straightforwardly obvious. It doesn't mean the companies shouldn't be held accountable for their failures, and certainly doesn't mean that we shouldn't expect them to to continue working on improvements.

Comment Might work on the easy problems (Score 1) 51

This might work when there is a simple, easy search that can verify a fact. But that's often not the case. In my experience most cases of hallucination are cases where the LLM needs a fact mid-response, and the fact check requires both a non-trivial query and complex evaluation of the response data, sometimes involving judgement calls. When that happens, the LLM just gets lazy and goes with its guess rather than doing the check.

I'm speaking in the context of advanced models, mind, not the kind of thing that was available in 2022, nor the kind of thing that is available in Google search's limited-capability model, or open source models. Those are far more prone to hallucination. I won't say that, say, Claude Opus never hallucinates, because it does... but the hallucinations are common only when the models is being pushed hard, operating near the limits of its capacity, which makes it prone to taking shortcuts.

Comment Re:Cool Cool (Score 2) 72

Trump could waive student debt and the republicans would stand up with tears in the eyes yelling bravo sir! Biden tried it and was immediately stopped by the courts.

Well, I think Trump would be immediately stopped by the courts, too. Probably faster than they stopped Biden, since they've very reasonably gotten intensely skeptical of almost everything this administration does.

Partisanship aside, presidents really should obey the law. If the law is bad, the solution is to change it, not to break it. Yes, that means we need a functioning Congress, something we haven't had for quite some time, but that's still no reason to break the law.

Comment Re: this sure reminds me of a time (Score 1) 67

I am late to the party and I was just going to read rather than comment, but your comment brought home the whole conversation here. Even when trashing people that have no respect for the truth or for you, it is of importance to you that the trashing is an accurate and fair comment. It so epitomises the difference we are talking about between people here. Sadly the Internet is not kind to people who enforce truth.

Indeed, truth and accuracy is important to me, and I think it should be important to everyone. It baffles me that so many people don't seem to care about whether what they believe or say is true. I recognize that those people who care are often in the minority, but that just makes it harder to understand, not easier.

Slashdot Top Deals

If it has syntax, it isn't user friendly.

Working...