In the week the New York Knicks won their first title in fifty-three years, the cybercrime group ShinyHunters breached their parent company, Madison Square Garden Sports, and dumped nearly ten million email addresses onto the web. A check of the DNS shows the Salesforce domain that mails fans their ticket codes locked down against forgery, while the corporate domain behind guest relations, group sales and the front office sits unprotected, which is where a single convincing phishing email would now do the damage.
On 5 June, the day the New York Knicks won their first title in fifty-three years, the cybercrime group ShinyHunters breached Madison Square Garden Sports. The group ran its usual pay-or-leak extortion, and when the ransom deadline passed on 15 June it published the data the next day, timed to land while the city was still celebrating. Have I Been Pwned listed the breach on 24 June with 9,796,738 email addresses, spanning staff and customers, alongside names, phone numbers and postal addresses.
One clarification the coverage keeps getting wrong. The teams business, Madison Square Garden Sports, owns the Knicks and the Rangers. The venues business, MSG Entertainment, runs the arena and the facial-recognition system that drew the headlines. Have I Been Pwned listed the Sports company. This is about the mail domains behind it.
A list like this is not dangerous because it holds secrets. It is a targeting file. Ten million people who bought tickets or contacted the club, handed to a group whose habit is to phish them. The obvious lure writes itself: a message that looks like it came from the address fans already get ticket codes from, telling them to verify their account after the breach. The only control that stops a forged From line is DMARC set to enforce. SPF and DKIM check the plumbing behind a message. Only DMARC at quarantine or reject tells a receiver to bin mail that fails in the name the recipient actually sees.
So we read the DNS. The result is not the tidy failure you might expect. It is half done, and the half that is finished is the half that matters most for a mass phishing run.
Start with the good news, because it is real. The address fans receive ticket codes from is newyorkknicks@email1.msg.com. That sending domain is operated through Salesforce Marketing Cloud, publishes an SPF record that ends in a hard fail, and carries its own DMARC policy of p=reject at full coverage. Forge that address and a compliant receiver rejects the message. The single most valuable lure for anyone holding this list, a fake ticket-code email from the genuine sending address, is blocked. The corporate teams domain, msgsports.com, is in the same shape: hard-fail SPF and DMARC at reject.
Now the gap. The parent domain, msg.com, sits at p=none, with sp=none for its subdomains. That is monitoring only. Receivers are asked to watch and report, not to act. And msg.com is not a backwater. It is the shared corporate backbone across the whole operation. The club’s own press page lists msgspr@msg.com as the contact for both the Knicks and the Rangers, MSGScorpcomms@msg.com and MSGEcorpcomms@msg.com for corporate and financial matters, alongside the customer-facing guest-relations and group-sales addresses on the same domain. Every one of those can be forged, and the published policy tells receivers to let it through.
So the exposure is not the mass ticketing blast, which is locked. It is the human side. A targeted message spoofing guest relations to a named customer whose address just leaked. A finance or corporate-comms address impersonated for a business email compromise attempt. The bulk channel is shut. The conversational one, where a single convincing email does the damage, is open.
The shape of this is familiar to anyone who has run a DMARC rollout. Enforcement reaches the clean, single-purpose sending stream first, because a Salesforce subdomain does one job and its mail is easy to account for. The sprawling corporate domain is the hard mile. msg.com carries senders for Oracle Cloud, Atlassian, Salesforce, Zoom, Box and a long tail of other tools, and getting all of them aligned before flipping to reject is slow, cautious work. The reporting address on the record points to Valimail, a dedicated authentication vendor, so the monitoring is running and someone is watching. The domain has simply not crossed to enforcement. Monitoring is the first step of the journey, not the arrival.
Two limits keep this honest. DMARC protects the exact domain and nothing else. Reject on email1.msg.com and msgsports.com does nothing about a criminal registering a lookalike such as msg-tickets.com, which is a separate fight. And the residual exposure here is specifically the msg.com apex and its human addresses, not the automated sender, which is the opposite of where most people would assume the risk sits.
The lesson for anyone running mail at scale is not that MSG fumbled this. On the sending side it did the work, and it deserves the credit that most post-breach coverage never bothers to check for. The lesson is that reaching enforcement on your easy stream is not the same as finishing. The corporate domain is where the leaked list points now, and it is the one still waiting at p=none.
