Quick answer: Madison Square Garden sent Knicks business and arena staff a fake email saying “your Employee Championship Ring is here.” Staff who clicked were told they had failed a phishing test and must attend a cybersecurity class. MSG called using the rings as bait “an unfortunate mistake” and said it was recently hacked through a similar phishing attack.
The word “test” was trending on Google in India on Friday, and the story behind it is a strange mix of sport and cybersecurity. The New York Knicks, NBA champions for the first time in 53 years, used championship rings as bait in a phishing simulation for their own employees. It backfired publicly.
It is also a useful case study. If you run a business, manage a team, or simply get a lot of emails, there are real lessons here about how phishing works and how not to train people against it.
What happened at Madison Square Garden
The Athletic first reported the story on Thursday, and ESPN followed up with MSG’s response. Last month, some employees in Knicks business operations and at the arena received an email that said “your Employee Championship Ring is here.” It offered a choice between two options at “no cost to you.”
Employees who clicked the link were told they had failed a phishing test. They would now have to attend a mandatory cybersecurity class.
On Friday an MSG spokesperson admitted fault. In a statement quoted by ESPN, the company said the email was “a simulation of a phishing attack designed to strengthen our security against hackers,” and added: “MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees attention was an unfortunate mistake.”
Key facts
- Who was targeted: Employees in Knicks business operations and at Madison Square Garden.
- The bait: An email titled around an “Employee Championship Ring,” offered at “no cost.”
- The result of clicking: A failed phishing test and a mandatory cybersecurity class.
- MSG’s explanation: The company had recently been hacked and extorted after a real phishing attack stole an employee’s login.
- The real rings: MSG says it is giving more than 275 rings and jewellery items, worth over $3.7 million in total, to players, coaches, staff and others.
- Related issue: Some Knicks assistant coaches were handed empty ring boxes at the ceremony because they had not yet been fitted, The Athletic reported and a source confirmed to ESPN.
Why the ring email worked so well
From a pure security angle, the email was well designed. That is exactly the problem. It used the three levers real attackers rely on.
1. Emotion
The Knicks had just ended a 53-year title drought. Staff were proud and excited. An email that ties into a big emotional moment gets clicked without much thought.
2. Something for free
“No cost to you” is one of the oldest hooks in phishing. People lower their guard when they think they are receiving, not paying.
3. Plausibility
The team really was handing out rings. Employees had every reason to believe some staff would get one. The best phishing emails are not obviously fake. They are believable.
Why security experts dislike this kind of test
Phishing simulations are a normal part of corporate security. Many companies run them. The debate is about what lures are fair. Using a reward that people genuinely hoped for, such as a bonus, a gift or, in this case, a championship ring, can make employees feel tricked by their own employer. That erodes trust, and trust is what security teams need when they ask people to report suspicious emails.
MSG’s own statement concedes the point. Calling the lure “an unfortunate mistake” is an admission that the choice of bait hurt more than it helped. It did not help that some coaches were, at the same time, holding empty boxes on ring night.
That said, the underlying threat is real. MSG says a real phishing email led to a hack and an extortion attempt. Attackers would happily use the same kind of bait.
Lessons for Indian businesses and employees
India sees plenty of phishing built around the same ideas: a festive bonus, a free gift, a refund, a KYC update. Diwali season is a classic time for it. Here is what the Knicks story teaches.
For employees
- Be most careful with emails that promise something you want. Excitement is exactly what attackers aim for.
- Check the sender’s actual address, not just the display name.
- If a “reward” arrives by email, confirm it through a separate channel, such as HR or your manager, before clicking anything.
- Never enter your work login on a page you reached from an email link.
For employers
- Run phishing simulations, but choose lures that will not feel like a betrayal if people fall for them.
- Focus on making reporting easy and praised, rather than only punishing clicks.
- Turn on multi-factor authentication. A stolen password alone should not be enough to break in.
India’s national cybersecurity agency, CERT-In, publishes advisories on current phishing campaigns, and cybercrime can be reported on the government’s portal at cybercrime.gov.in or by calling 1930.
FAQ
What was the Knicks ring phishing test?
MSG sent employees a simulated phishing email offering a free “Employee Championship Ring.” Those who clicked were told they had failed a security test and had to attend a cybersecurity class.
Why did MSG run the test?
MSG said it was recently hacked and extorted after an employee’s login was stolen through a similar phishing attack, and the simulation was meant to strengthen security.
Did MSG apologise?
A spokesperson said using the rings as a lure was “an unfortunate mistake.”
How can I spot a phishing email?
Watch for unexpected rewards, urgent requests, mismatched sender addresses and links asking for your login. When in doubt, confirm through a separate channel.