Knicks Used Fake Championship Ring Email to Test Cybersecurity Awareness

Madison Square Garden employees received a phishing email in late September that appeared to offer complimentary New York Knicks championship rings with personalized designs, only to discover upon clicking the link that they had failed a cybersecurity test and were required to attend mandatory digital security training. The email, which mimicked a legitimate offer from MSG to employees, was part of an internal security simulation exercise designed to strengthen the organization's defenses against hacking attempts. MSG Sports acknowledged the approach was "an unfortunate mistake" but explained the measure was taken following a recent security breach in which an employee's login credentials were stolen through a similar phishing attack.

The incident coincided with the Knicks' championship ring ceremony on opening night, where some assistant coaches received empty boxes instead of rings because they had not yet been fitted for the jewelry. The company is distributing over 275 championship rings and jewelry items valued at more than $3.7 million to players, coaches, employees, and other members of the Knicks organization in recognition of the franchise's first NBA championship in 53 years, achieved after defeating the San Antonio Spurs in the NBA Finals.

MSG Sports stated that the company had previously sent the phishing simulation email to its corporate team as part of its security awareness program. The decision to use the championship ring offer as bait for the phishing test drew attention given that many longtime MSG employees, including some in the Knicks business operations, were not receiving rings at all. The situation highlighted the tension between conducting necessary cybersecurity training and managing employee expectations during a celebratory corporate moment.