Oracle EBS 2025 Campaign Impacts Madison Square Garden, Sensitive Data Leaked

Key Takeaways

• MSG breach linked to Oracle EBS 2025 campaign.
• Cl0p ransomware stole 210GB of MSG data.
• Over 100 organizations affected by CVE‑2025‑61882.
• Oracle issued emergency patch in October 2025.
• MSG offers one‑year credit monitoring to victims.

Summary

Madison Square Garden confirmed a data breach tied to the 2025 Oracle E‑Business Suite hacking campaign. The Cl0p ransomware group exploited a zero‑day vulnerability (CVE‑2025‑61882) to steal over 210 GB of archived files, including employee payroll and Social Security numbers. MSG refused to pay ransom, leading the attackers to publicly leak the data. The venue responded with law‑enforcement notification, forensic investigation, and a one‑year complimentary credit‑monitoring service for affected individuals.

Pulse Analysis

The Oracle E‑Business Suite zero‑day (CVE‑2025‑61882) surfaced in mid‑2025, granting unauthenticated attackers remote control of the Concurrent Processing component. With a CVSS score of 9.8, the flaw quickly became a prime vector for the Cl0p ransomware gang, which leveraged it to exfiltrate data from more than a hundred organizations worldwide. Oracle’s emergency patch released in October 2025 forced customers to accelerate remediation, yet many legacy deployments remained unpatched, exposing a systemic weakness in enterprise ERP security. Analysts warn that similar flaws could emerge in other Oracle modules, amplifying the attack surface.

Madison Square Garden, a globally recognized entertainment venue, found itself on the breach list when Cl0p accessed its Oracle EBS instance in August 2025. The attackers extracted over 210 GB of archived files, including employee payroll records and Social Security numbers, and later published the data after the venue refused ransom payment. MSG’s response included notifying law enforcement, engaging forensic specialists, and offering affected individuals a year of free credit‑monitoring through Cyberscout. The incident underscores how high‑profile brands are vulnerable when third‑party vendors manage critical ERP systems.

The breach highlights a broader supply‑chain risk: organizations that outsource ERP hosting must enforce rigorous patch‑management and continuous monitoring. Failure to apply Oracle’s October patch left MSG exposed despite vendor oversight, a scenario replicated across many sectors, from finance to healthcare. Cyber‑insurance carriers are likely to tighten underwriting criteria, demanding proof of timely remediation for critical vulnerabilities. As ransomware groups continue to weaponize zero‑days, enterprises must adopt a zero‑trust posture, integrate threat‑intel feeds, and conduct regular red‑team exercises to validate defenses. Investments in automated vulnerability scanning and AI‑driven anomaly detection are becoming essential to stay ahead.