Madison Square Garden Sports, the parent company of the New York Knicks, has admitted that an email offering staff free NBA championship rings was a phishing test. Employees who clicked to reserve a ring were sent to a mandatory cybersecurity class instead.
It says it will hand out more than 275 championship rings and pieces of jewellery, worth over $3.7 million, to players, coaches, employees and others in the organisation. The Knicks won the 2026 NBA title in June, their first since 1973, and the franchise is still in the middle of celebrating it.
Which obtained a copy, it opened with a graphic of two ring styles and the line “Congratulations, your Employee Championship Ring is here, according to The Athletic. Each employee was addressed by name and told the ring was complimentary, personalised and made by the same jeweller as the players’ rings. The company has now called it an “unfortunate mistake. The timing made the episode sting. There were two designs to pick from: Championship Gold and Garden Classic.
The email went out to a long list of MSG employees in late September, weeks before the team’s ring-and-banner ceremony.
The Garden has used facial recognition at its entrances since at least 2018, and in 2023 it was reported to have used the system to turn away lawyers from firms involved in litigation against the company.
MSG has not said how many employees clicked the September email, or whether it plans to change how it runs these tests. Security tech has been a sore point at MSG for a while. You use AI every day. Now get your AI Quotient. Take the AIQ test.
A database leaked earlier this year also showed MSG assigning risk scores to celebrities and their guests.
GoDaddy faced a similar backlash in 2020, when a fake holiday bonus email to staff turned out to be a security test. In a recent report, Kaspersky found that a FIFA-themed phishing simulation offering prizes for wearing a national team jersey got a 66% click rate. Because people act on them quickly and without much thought, attackers often dress up phishing emails as rewards.
Team sources told The Athletic that those who clicked were put through a cybersecurity class tied to owner James Dolan’s growing concerns about hacking. A spokesperson said the email was a phishing simulation sent to the corporate team to strengthen its security against hackers. “MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack,” the statement said. Guidance from the US National Institute of Standards and Technology says such exercises should not be punitive. The UK’s National Cyber Security Centre says punishing employees for falling for a test email can start to look like entrapment.
It was an easy offer to believe. Most NBA team employees receive a ring after a title, even if it is a simpler version of what the players wear. MSG’s first response to The Athletic was short: “We are not disclosing anything about the rings. A day later, the company changed course. It added that using the rings as a lure “was an unfortunate mistake. Phishing drills are routine at large companies, so the criticism is mostly about the bait. From a pure security standpoint, the ring was an effective lure. The trouble lies in what happens after the click. It also advises companies to check with HR before sending anything that could upset staff, which a fake championship ring offer was always likely to do.