Madison Square Garden’s internal security apparatus has been exposed as assigning risk scores to approximately 400 celebrities and high-profile individuals, including loyal fans like rapper Fat Joe, according to documents obtained from a major data breach. The revelations stem from a trove of files published last month by the criminal hacker collective ShinyHunters, offering an unprecedented look into the arena operator’s surveillance practices targeting its most visible guests.
The VIP database, internally referred to as the “talent” roster, contains 39,539 entries covering boldfaced names across business, technology, politics, media, and sports. However, only about 400 of those entries carry a risk score. Among those flagged are courtside regulars including Edie Falco, Mark Ronson, John Turturro, and Tracy Morgan. Fat Joe, a vocal supporter of Knicks owner James Dolan who celebrated with him after the team clinched the NBA finals, is designated as “medium risk.”
How Madison Square Garden’s Security Team Assigns Risk Scores
The risk scoring system operates independently of traditional physical security threats, which are documented in a separate database. A source familiar with the matter explained that Garden security conducts social media sweeps for high-profile individuals seeking complimentary tickets. If a celebrity receives any risk designation — even “low risk” — it indicates they have attracted negative attention from security personnel through public statements or online activity.
“It doesn’t have to be that serious. You could just be critical of the team or the place itself,” the source noted. “You could post that you had a hard time getting in and you really didn’t like the way you were treated at one of the gates. Which is really nothing, right?”
The talent database, with entries dating back to December 2020 and updates as recent as early June, repeatedly references “SM concerns” — shorthand for social media monitoring. This aligns with previous reporting on MSG’s aggressive surveillance posture. The organization has previously targeted fans for criticizing Dolan, including requesting local law enforcement visit a 14-year-old in Colorado over a single tweet. “They scared the crap 💩 out of some 14 year old kid in Colorado,” an MSG security staffer texted in a message reviewed by WIRED.
Fat Joe’s Risk Score Traces to an Associate’s Criticism
Fat Joe’s “medium risk” classification provides a window into the sprawling nature of MSG’s threat assessment methodology. According to the source, the rapper was flagged not for his own statements but due to his association with fellow New York rapper Jadakiss, who has a history of criticizing Dolan. Jadakiss is also designated as “medium risk” in the database, while the other members of his hip-hop trio, the Lox, appear in the system without any risk score.
“It seems like he’s always more happier when the team sucks,” Jadakiss said of Dolan in 2020. That remark appears to have been sufficient to earn the rapper a permanent security classification within MSG’s systems.
The database does not provide explicit reasoning for most risk designations, but the pattern suggests Garden security casts a wide net, cataloging any online negativity — however mild — directed at the organization or its leadership.
What the Breach Reveals About Corporate Surveillance Practices
The ShinyHunters breach has exposed the extent to which MSG embeds social media monitoring into its guest management workflows. While the source noted that such databases are common at major venues, the systematic labeling of high-profile fans based on online sentiment represents an escalation in how organizations pre-judge attendees before they even enter the building.
For the roughly 39,000 individuals in the talent database who carry no risk score, the system remains invisible. But for the 400 who are flagged — including some of the most recognizable faces in New York sports culture — the database functions as a permanent record of perceived loyalty or dissent, maintained and updated over years.
What Affected Individuals Should Do Now
Anyone who believes their personal data may be included in this breach should take immediate precautions. Change passwords on any accounts associated with MSG or related ticket platforms, and enable two-factor authentication wherever available. Monitor financial accounts and personal information for signs of misuse, as breach data often circulates among criminal networks. For those concerned about social media monitoring by corporate entities, review privacy settings on public profiles and consider limiting visibility of posts that could be misconstrued as security risks. Using a reputable VPN with a verified no-logs policy and AES-256 encryption when accessing venue networks can help protect your digital footprint from similar surveillance programs. The broader lesson is clear: in an era where a critical tweet can earn you a permanent risk score in a corporate database, understanding who holds data about you and how they classify it is a fundamental privacy concern.
