The New York Knicks organization sent employees a fake offer of championship rings in a phishing test, according to a report, using the team’s long-awaited title celebration as bait to see who would click. The stunt came just days after the Knicks raised their first championship banner since 1973, and it appears to have caught at least some Madison Square Garden employees off guard.
A phishing test built around championship rings
The email went out in late September and told recipients: “Congratulations, your Employee Championship Ring is here,” according to The New York Times, which cited team sources. Employees were asked to click a link to choose between two ring designs, turning a real-world celebration into what was apparently a security drill.
Phishing tests are common in large organizations, especially after a real security incident. Companies often send fake internal emails designed to look legitimate, then track which employees follow the prompts and click through to a malicious-looking link. The goal is usually training rather than punishment, though the result can still be embarrassing, irritating, or both.
In this case, the lure was especially specific. The email promised a complimentary employee championship ring and included graphics showing two different styles that recipients could supposedly reserve. One of the most effective parts of phishing is making a message feel timely and plausible, and the Knicks email leaned heavily on the team’s actual title celebration.
Why the fake ring offer worked as bait
The offer was not obviously absurd. Joe Vardon, senior NBA writer for The Athletic, wrote that most employees around NBA teams receive rings of some kind, even if they are not as elaborate as those given to players. That detail matters because it makes the fake offer easier to believe, especially for staff members who knew a championship ring would be part of the wider celebration.
The email’s wording was designed to sound generous and official. “(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you,” it reportedly said. It then directed recipients to choose between “Championship Gold” and “Garden Classic.”
Ars Technica noted that, in its own workplace, phishing tests sometimes use obvious red flags such as a misspelled domain name. But the report said it was not clear whether the Knicks email had any similar telltale mistake. That ambiguity is part of what makes the incident notable: the lure may have been realistic enough that some staffers would not immediately have recognized it as a test.
Mandatory cybersecurity class for some employees
According to The New York Times report, employees at Madison Square Garden who clicked the link were forced to attend a mandatory cybersecurity class. The report said that was intended to help satisfy owner James Dolan’s growing cybersecurity concerns. Dolan owns the Knicks, the New York Rangers and Madison Square Garden.
The idea of a required class after clicking a phishing link fits a familiar corporate response pattern. Organizations often pair simulation campaigns with follow-up training so employees can learn what clues they missed and how to handle similar messages in the future. In practice, though, such exercises can feel less like a lesson and more like a trap if the bait is unusually enticing.
The sports angle also made the episode easier to notice. A fake offer of a championship ring is not a generic IT test or a routine benefits email; it is tied directly to a franchise milestone. That timing helped turn the phishing campaign into a story in its own right, especially because the Knicks were already in the spotlight for their championship-related ceremonies.
What the Knicks and MSG said
After the report circulated, Madison Square Garden Sports issued a statement describing the phishing test as “an unfortunate mistake.” The company said it had sent the email “to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers.” It added that MSG had recently been hacked and extorted using employee login credentials obtained through a similar phishing attack.
That statement helps explain why the company was running a phishing simulation in the first place. If a real attack had already succeeded using stolen employee credentials, it would make sense for the organization to tighten security and train staff more aggressively. The problem, according to MSG’s own explanation, was the choice of lure.
“Using the rings as a lure to gain employees’ attention was an unfortunate mistake,” MSG said. The company also addressed the wider ring plan, saying it was “gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.”
Rings, banners and mixed messages
The phishing episode landed in the middle of a broader championship celebration that also included some confusion over who would receive what. Vardon reported that Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. Instead, they were given empty boxes and told they would receive rings later.
That part of the story is separate from the phishing email, but it shows how many moving pieces can surround a major sports celebration. Ring orders, designs and measurements can take time, and not every member of a staff is always handed a finished ring on the same night as the banner ceremony. According to the report, some longtime MSG employees, including some in the team’s business operations, will not receive rings at all.
Against that backdrop, a message promising a free employee ring was bound to attract attention. For a team and a company trying to celebrate a rare title while also tightening security, the result was a reminder that context can make a phishing test feel very different from a typical training email.
Why this story stands out beyond basketball
The Knicks story is unusual because it combines a routine cybersecurity practice with one of the most emotionally loaded rewards in sports. Phishing tests usually rely on urgency, authority or fear. Here, the lure was prestige and celebration, making the message feel more like a perk than a threat.
It also illustrates a challenge for organizations that want employees to stay alert without making security awareness feel punitive. The best phishing simulations are often the ones that mirror real-world scams closely enough to be educational, but not so closely that they blur into a morale problem. In this case, the choice of bait crossed into territory that was memorable for all the wrong reasons.
For the Knicks, the bigger security lesson may be straightforward: even a celebratory email can become a phishing vehicle if the organization is not careful about how it frames the message. And for employees, the lesson is equally simple: if a message arrives promising a valuable reward out of nowhere, even from inside the company, it is worth checking twice before clicking.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 24, 2026 at 10:31 pm
0 views
