June 18, 2026  ·  Updated July 14, 2026  ·  United States District Court Southern District of New York, No. 1:26-cv-05184

By David Brunk, civil litigation attorney

Read the complaint

Alan Pitt, individually and on behalf of all others similarly situated, v. Madison Square Garden Sports and Madison Square Garden Entertainment Alleges Data Breach of 26 Million

Alan Pitt has filed a class action lawsuit against Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp. in the United States District Court for the Southern District of New York. The complaint, filed on June 18, 2026, centers on a significant data breach said to compromise the personal information of approximately 26 million individuals. According to the complaint, the breach was attributed to the group "ShinyHunters" and involved over 42 GB of sensitive data, potentially leading to exposure on the dark web.

The complaint alleges that the defendants failed to implement adequate security measures, resulting in the exposure of private information to unauthorized parties. It claims violations of several laws, including Section 5 of the Federal Trade Commission Act, which prohibits unfair acts or practices. The suit seeks damages and injunctive relief, including enhanced security measures, breach notifications, and credit monitoring for affected class members.

Core Mechanism of the Breach

The class action complaint against Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp. alleges that the defendants failed to implement reasonable data security measures, leading to a significant data breach. According to the complaint, this breach resulted in the compromise of private information belonging to approximately 26 million individuals. The inadequacy of the defendants' security protocols is highlighted by ShinyHunters, a threat group that claimed responsibility for the breach.

Following the breach, the exposed information was potentially made available on the dark web, increasing the risk of misuse of the compromised data. The filing contends that the data security failures included not deploying adequate measures to protect the information from unauthorized access, which the plaintiffs argue constituted negligence on the part of the defendants. As a result, the complaint seeks redress for the affected individuals, including compensatory and punitive damages, as well as injunctive relief to enforce stronger data protection measures in the future.

These allegations are part of a broader set of claims against the defendants, underlining the heightened risks and potential harms associated with the breach. The plaintiffs assert that the defendants were aware of the need for robust data security but chose not to implement the necessary protections, thereby breaching their legal obligations to the data subjects.

Monetary Aspects of the Breach

The class action complaint filed by Alan Pitt against Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp. seeks to address the significant monetary implications of a data breach involving the exposure of personal information belonging to approximately 26 million individuals. The complaint states that more than 42 GB of uncompressed internal files, containing sensitive information, were affected by the breach. This large volume of compromised data includes details valuable on the black market, potentially exacerbating the economic impact on the affected individuals.

From a legal perspective, the amount in controversy due to the breach exceeds $5,000,000, meeting the threshold for federal jurisdiction under the Class Action Fairness Act (CAFA). The exposed information, labeled as "Fullz" on the dark web, can command a price of up to $100 per record, as alleged in the complaint. This valuation suggests a substantial potential market value for the compromised records, which could complicate remediation efforts for the affected parties.

Furthermore, the complaint cites the criminal information black market where stolen Personal Identifiable Information (PII) and Personal Health Information (PHI) from the breach command values of up to $2,000.00 per set of data. This elevated value highlights the severity of the breach's impact on the individuals involved, given the potential for significant misuse and fraud arising from the illicit sale of compromised information.

The complaint implies that the economic ramifications extend beyond direct monetary theft to include the costs associated with restoring security and mitigating future risks. It contends that this breach resulted, in part, from alleged negligence by the defendants in their data security measures. Ultimately, the Plaintiff seeks damages reflective of these varied and significant economic impacts, intended to redress both the market value of the information lost and the broader financial implications for those affected.

Parties Involved

The plaintiff, Alan Pitt, has initiated the class action lawsuit following a data breach that compromised the personal information of millions of individuals. This personal information was among the data exposed in the breach affecting an estimated 26 million individuals.

The defendants in this case are Madison Square Garden Sports Corp. (MSG Sports) and Madison Square Garden Entertainment Corp. (MSG Entertainment). The complaint implicates these companies in various claims, including negligence and breach of fiduciary duty, among others.

The class members consist of approximately 26 million individuals whose private information was compromised in the data breach. The complaint indicates that this breach has resulted in increased risks and potentially significant personal and financial impacts for those affected, serving as the central concern of this legal action.

Negligence and Breach of Duty Claims

The complaint alleges that Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp. failed to implement adequate data security measures, leading to the compromise of private information belonging to approximately 26 million individuals. The lawsuit contends that the defendants neglected to employ security frameworks such as the NIST Cybersecurity Framework and CIS Critical Security Controls, which are recognized industry standards for protecting sensitive data.

This purported negligence allegedly facilitated unauthorized access to, and dissemination of, personal information by third parties, such as the group ShinyHunters, who claimed responsibility for the breach.

The claims of negligence and breach of fiduciary duty are central to the legal action brought against Madison Square Garden entities, forming a significant part of the plaintiffs' demand for damages and injunctive relief. These allegations underscore the responsibility of corporations to maintain rigorous data protection measures and the potential consequences when they fail to do so.

Statutory Breach and Unjust Enrichment Claims

The complaint filed by Alan Pitt, on behalf of himself and others similarly situated, claims that the defendants, Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp., violated Section 5 of the Federal Trade Commission Act (FTCA), 15 U.S.C. § 45. According to the filing, the defendants' failure to employ reasonable and appropriate data security measures resulted in the exposure of private information, constituting an unfair act or practice under the statute (Compl. ¶80). The plaintiffs argue that such a violation of federal guidelines, which demand the implementation of security measures to protect consumer data, amounts to negligence per se (Compl. ¶120).

In addition to breach of statutory duty, the complaint brings a claim for unjust enrichment against the defendants. The filing alleges that Madison Square Garden corporations profited unjustly by failing to invest in necessary data security measures, which allowed them to avoid significant costs associated with safeguarding private information (Compl. ¶132). The plaintiffs contend that the expenditure avoided by the defendants directly contributed to their profits while compromising the security of private information, resulting in harm to the plaintiff and the class members.

The complaint seeks remedies including restitution and disgorgement of profits gained through cost savings on neglected security investments. The plaintiffs argue that the defendants received and retained benefits from the plaintiff and class by holding their private information without adequate protection, thus securing financial benefits by cutting expenses which should have been dedicated to ensuring data security (Compl. ¶131-132).

This case highlights concerns around corporate compliance with established data protection laws and the economic advantages firms might gain through inadequate security investments. The allegations remain unproven, and no response has yet been filed by the defendants.

Implied Contract and Damages

The complaint in Alan Pitt v. Madison Square Garden Sports Corp. and Madison Square Garden Entertainment Corp. alleges a breach of implied contract between the defendants and the nationwide class. This claim centers on the defendants' failure to adequately protect the private information entrusted to them by the class members, including the plaintiff, Alan Pitt. According to the complaint, defendants’ commitments and conduct implied a promise to implement appropriate safeguards to prevent unauthorized disclosure of this sensitive information, which was not upheld as evidenced by the data breach (Compl. ¶163-164).

The alleged breach resulted in various forms of damages for the plaintiff and the class members. The complaint details that the class has suffered monetary losses attributed to efforts and expenses required to mitigate the effects of the data breach. These impacts include expenditures on credit monitoring services and other out-of-pocket costs associated with protecting their identities and financial information from unauthorized use (Compl. ¶148). Furthermore, the complaint claims that members have endured lost time and productivity, which they were forced to dedicate to securing their personal data (Compl. ¶39).

These damages are highlighted as part of the broader claims for relief and compensation sought within the class action lawsuit, which include compensatory, punitive, and nominal damages, based on the extent and nature of the harm suffered by the class members.

Ultimately, the claimed breach of implied contract adds a dimension to the lawsuit that underscores the expectation of privacy and security that consumers reasonably hold when providing their sensitive information in exchange for services. The outcome of this claim, as part of the larger class action suit, will hinge on the court's assessment of the implied contractual obligations and the adequacy of defendants' data protection measures.

Relief Sought and Procedural Posture

The complaint in Pitt v. Madison Square Garden Sports Corp. seeks several forms of relief, including the certification of a Nationwide Class under Federal Rule of Civil Procedure 23. This entails defining a class of individuals whose private information was compromised in the alleged data breach. The plaintiff, Alan Pitt, seeks compensatory damages, punitive damages, and nominal damages for the alleged negligent and unlawful conduct of the defendants (Compl. ¶129).

The action also requests injunctive relief, which would require the defendants to enhance their data security protocols to prevent future breaches. This includes not only improved security measures but also the prompt notification to all class members about the data breach and providing them with lifetime credit monitoring services.

An important aspect of the relief sought is the establishment of a constructive trust. The complaint seeks remedies including financial restitution for affected individuals (Compl. ¶138).

As of the filing date, no procedural rulings have been made, and The defendants have not yet responded to the complaint.

The allegations described here are taken from the filing and remain unproven; no responsive pleading is reflected in the source document.

The allegations described here are taken from the filing and remain unproven; no responsive pleading is reflected in the source document.

David Brunk is a civil litigation attorney. He can be reached at david@newmanbrunk.com.