Leaked Madison Square Garden database tracked thousands of public figures by sexuality, risk level

A database exposed in a hack of Madison Square Garden’s computer systems shows the venue’s security team included LGBTQ labels for dozens of public figures and assigned hundreds of performers a “risk” rating that Wired found frequently tracked whether they had criticized the arena’s owner, according to the outlet’s investigation.

Hackers calling themselves ShinyHunters tricked a low-level Madison Square Garden employee over a phone call into giving them access to the company’s computer systems, a technique known as “vishing,” according to a 404 Media investigation into the breach. The group published the stolen data after Madison Square Garden did not meet its ransom demands, 404 Media first reported in June. The data included a list of “talent” — among them former New York Knicks players and coaches — along with risk labels and emails between customers and the arena. 

Wired reporters who reviewed the leaked files found a “talent” database of nearly 40,000 names spanning entertainment, politics, business and sports. Of those, 93 entries were marked “LGBTQIA,” including Ricky Martin, Phoebe Bridgers and Geese guitarist Emily Green, according to Wired’s reporting, as detailed by Them, republished by the Advocate. Some entries also noted a person’s race or gender identity.

Roughly 400 people in the database were separately assigned a risk score — “flag,” “low risk,” “medium risk” or “high risk” — which Wired reported often, though not always, appeared to reflect whether the person had criticized James Dolan, the executive chairman and chief executive of Madison Square Garden Sports and Entertainment. Rappers Freddie Gibbs, Lil Jon, DaBaby and A Boogie Wit da Hoodie were listed as “high risk,” while Morgan Wallen, Lily Allen and Jadakiss were marked “medium risk,” and Ice Spice, Selena Gomez and Benson Boone were “low risk,” per the Stereogum summary of the Wired findings.

Producer and DJ Pete Rock, a self-described lifelong Knicks fan, was marked “DO NOT HOST.” He has said he believes the label followed his public call for a boycott of Mr. Dolan after Knicks enforcer Charles Oakley was forcibly removed from the arena. Rock told Wired the venue “can’t stop me from being a Knick fan,” but called the arena’s treatment of him “very unprofessional.”

Digital rights advocate Evan Greer, director of Fight for the Future, told Wired the venue’s leadership seems “overly interested in queer and trans people in their venue.” The comment referenced an earlier Wired report that Madison Square Garden security tracked a transgender Knicks fan’s movements throughout the arena for two years before banning her, a pattern documented in a subsequent lawsuit against Mr. Dolan’s chief security officer. 

The database’s surveillance practices reportedly extend to the Sphere in Las Vegas and Radio City Music Hall in New York, both owned by Mr. Dolan’s company.

Madison Square Garden is now facing multiple federal class-action lawsuits over the breach. One complaint, filed in the U.S. District Court for the Southern District of New York, alleges the venue failed to implement reasonable cybersecurity measures to protect the trove of information it collects from employees and the millions of visitors, sports fans, concertgoers and celebrities whose information it collects each year, according to ClassAction.org’s coverage of the filing. The suit contends the venue has combined facial-recognition data with social media activity since 2018 to build threat-assessment profiles on visitors.