Knicks Staff Were Lured Into a Cybersecurity Test With an Offer of Championship Rings

'Congratulations, your Employee Championship Ring is here', an email told Madison Square Garden staff in late September. It promised a complimentary, personalised keepsake from the Knicks' championship season and invited employees to choose a design, according to a copy obtained by The Athletic.

The offer was an internal phishing test. Employees who clicked were required to attend cybersecurity training, the publication reported. MSG subsequently acknowledged that using rings as bait was a mistake, then apologised to employees and fans while defending the purpose of the exercise.

The Email Offered Personalised Championship Rings

The message addressed recipients by name and presented the ring as a gift from their employer. It included an image of two designs, making the invitation look like an opportunity to select a reward.

'The same jeweler, the same craftsmanship, personalized with your name. No cost to you', it read. Employees were offered a choice between Championship Gold and Garden Classic, with a link below to reserve their preferred version.

The invitation tied a workplace request to a shared achievement. A championship ring represents participation in the team's success, and the email extended that recognition directly to the person reading it. Selecting a design was presented as the next step towards receiving the gift.

Clicking instead led to a training requirement, according to the reporting. The link was part of an employer-run simulation, rather than an external attacker's attempt to steal information. The account does not establish that recipients submitted passwords or other credentials.

MSG Defends the Test's Purpose and Apologises for the Bait

MSG's first response, reported on 23 October, supplied a security rationale. The organisation said it had recently been hacked and extorted after an employee's login and password were obtained through a similar phishing attack. That account came from MSG; the reports do not independently establish the technical details.

A second statement on 24 October drew a distinction between protecting the organisation and using championship rings to attract attention. MSG defended reminding employees to protect its intellectual property, but said 'the choice to use the ring to do so was a mistake and we apologize to our employees and the fans'.

In the later statement, MSG said its plan had always been to distribute more than 275 rings and jewellery items to people in the organisation who contributed to the championship season.

Players received their rings during the 20 October opening-night ceremony. MSG said everyone else covered by the distribution plan would receive theirs in about four to six weeks. That was an estimated timetable, not confirmation that delivery had occurred.

The real distribution plan and the simulated selection email were therefore separate matters. The apology acknowledged the misleading invitation without establishing that every employee was entitled to a ring or that everyone receiving the test would be excluded.

Clicks Alone Do Not Explain a Test's Results

Research presented by the US National Institute of Standards and Technology explains why phishing-test click rates need context. Messages differ in how difficult they are to recognise, so clicks alone cannot provide a complete assessment of employees' proficiency or a training programme's effectiveness.

That principle is not an assessment of MSG's exercise. It does, however, distinguish the action recorded by a test from a broader judgement about the person who clicked.

Here, the message used names, design choices and the promise of recognition to prompt a response. MSG continued to defend its security objective, but the incentive chosen to draw employees into the exercise became the element it acknowledged was a mistake and apologised for publicly.