Knicks sent employees fake offer of championship rings in phishing test: Report

The New York Knicks organization sent employees a phishing email promising free championship rings in a test of its staff’s ability to detect scams, The New York Times reported yesterday. “Congratulations, your Employee Championship Ring is here,” the email sent in late September said, instructing employees to click a link to make a selection from two ring designs.

Madison Square Garden employees who clicked that link “were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan’s growing cybersecurity concerns,” the report said, citing team sources. Dolan is the owner of the Knicks, the New York Rangers, and Madison Square Garden.

It’s common for corporations to send phishing emails to find out which employees don’t pay attention to clues that an email is a scam. A cybersecurity-test email often appears to be from the company itself but includes telltale signs of phishing. For example, Ars Technica owner Condé Nast sends phishing-test messages from email addresses with a misspelled domain, “condenest.com.”

It’s not difficult for the typical Ars Technica reporter or editor to spot this kind of tell, but we haven’t received any offer as valuable as a free NBA championship ring. We can hardly blame a Knicks organization staffer for being fooled or at least greatly annoyed by a fake offer of a ring commemorating the basketball franchise’s first NBA championship in more than half a century.

We don’t know whether the Knicks email had any obvious signs that it was a phishing test, such as a misspelled domain name. The offer wasn’t implausible, either. “Typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive,” wrote Joe Vardon, senior NBA writer for The Athletic, which was bought by The New York Times in 2022 and then merged into the parent news organization.

Phishing email and empty ring boxes

Vardon’s article was primarily about how Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. The assistant coaches were handed boxes without rings inside, though they are expected to receive rings later on.

“Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night… The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks’ business operations, will not receive rings at all, team sources told The Athletic,” Vardon wrote.

MSG employee hopes were raised “at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings,” Vardon wrote. The email included “a graphic of two differently styled rings” that the lucky employees could supposedly choose from, the article said.

“(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you,” the email said. “There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below.”

Vardon wrote that “multiple team sources” confirmed the email was a phishing test. It’s not clear how many employees clicked the link, and it wasn’t immediately clear how many employees will eventually get some type of championship ring.

We contacted the Madison Square Garden Sports organization with these questions and received a statement after this article was published. The statement called the phishing test “an unfortunate mistake,” and detailed plans to give rings to staff.

MSG’s statement said the company “sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers. MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees’ attention was an unfortunate mistake.”

As for the ring-distribution plan, MSG said it “is gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.”

This article was updated with MSG’s statement.

1. Ice sheet expansion may have started 2,000 years ago, but we canceled that

2. Rocket Report: SpaceX says no thanks to military launches; Spanish rocket nearly ready

3. Crows can evaluate visual info twice as fast as mammals

4. Inside the Pentagon, the pressure is on to find a home for a new spaceport

5. NASA updates lander plans for Moon landings, finally solves long-festering Orion issue