Madison Square Garden Kept a List of Gay Celebrities

Madison Square Garden maintained a database of nearly 40,000 VIPs containing highly sensitive personal attributes — including sexual orientation labels and blacklist designations — that were subsequently leaked by the ShinyHunters hacker collective. The root failure lies in the collection and storage of sensitive personal data categories (such as LGBTQIA+ status) that carry significant legal and ethical implications, combined with insufficient access controls that allowed the database to be exfiltrated. Collecting this type of sensitive data without a clear legal basis violates foundational data minimization and purpose limitation principles enshrined in major privacy regulations. Beyond the breach itself, the mere existence of such categorizations represents an organizational policy failure, as tracking individuals' sexual orientation for risk-scoring purposes is both ethically harmful and legally precarious in many jurisdictions.