{
    "@context": "https://schema.org",
    "@type": "NewsArticle",
    "@id": "https://badiyaa.com/msg-knicks-ring-phishing-test/#article",
    "mainEntityOfPage": "https://badiyaa.com/msg-knicks-ring-phishing-test/",
    "headline": "Madison Square Garden calls its fake Knicks championship ring phishing test an ‘unfortunate mistake",
    "description": "Staff who clicked a September email promising a free personalized Knicks ring were sent to a security class. MSG says a real phishing attack had already led to a hack and extortion.",
    "datePublished": "2026-10-26T05:57:10+00:00",
    "dateModified": "2026-10-26T06:10:26+00:00",
    "author": {
        "@type": "Organization",
        "name": "Badiyaa Editorial Desk",
        "url": "https://badiyaa.com/author/editorial-desk/"
    },
    "publisher": {
        "@type": "NewsMediaOrganization",
        "@id": "https://badiyaa.com/#organization",
        "name": "Badiyaa",
        "url": "https://badiyaa.com/",
        "logo": {
            "@type": "ImageObject",
            "url": "https://badiyaa.com/wp-content/uploads/2026/10/badiyaa-logo-color-600x60-1.png",
            "width": 600,
            "height": 60
        },
        "email": "badiyaavideo@gmail.com",
        "publishingPrinciples": "https://badiyaa.com/editorial-policy/",
        "correctionsPolicy": "https://badiyaa.com/corrections/",
        "actionableFeedbackPolicy": "https://badiyaa.com/contact/",
        "ownershipFundingInfo": "https://badiyaa.com/about/#ownership",
        "sameAs": [
            "https://www.facebook.com/profile.php?id=61595518283625",
            "https://www.instagram.com/badiyaa.com.ai/",
            "https://www.threads.net/@badiyaa.com.ai"
        ],
        "parentOrganization": {
            "@type": "Organization",
            "name": "Rezilient Digital",
            "url": "https://www.rezilientdigital.com/",
            "address": {
                "@type": "PostalAddress",
                "streetAddress": "Fl No 3, Nav Shyam Sadan, Plot No 38, Pestom Sagar, Chembur",
                "addressLocality": "Mumbai",
                "addressRegion": "Maharashtra",
                "postalCode": "400089",
                "addressCountry": "IN"
            },
            "sameAs": [
                "https://www.linkedin.com/company/rezilientdigital"
            ]
        }
    },
    "isAccessibleForFree": true,
    "inLanguage": "en-US",
    "wordCount": 886,
    "image": [
        "https://badiyaa.com/wp-content/uploads/2026/10/Madison_Square_Garden__MSG__-_Full__48124330357_.webp",
        "https://badiyaa.com/wp-content/uploads/2026/10/Madison_Square_Garden__MSG__-_Full__48124330357_-1024x576.webp"
    ],
    "articleSection": "Tech",
    "keywords": "cybersecurity, Madison Square Garden, New York Knicks, phishing, workplace",
    "articleBody": "Madison Square Garden has admitted that one of its own cybersecurity drills went too far. In late September, corporate staff at the company that owns the New York Knicks received an email telling them a free, personalized championship ring was waiting for them, with two designs to pick from. There was no ring. Anyone who clicked the link had failed an internal phishing test and was sent to a mandatory security class. The company addressed the episode in a statement on Friday, October 23, three days after the Knicks handed out championship rings to players before their season opener at the Garden. A spokesperson for MSG Sports said: “The company had previously sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers. MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees attention was an unfortunate mistake.” The spokesperson added that MSG Sports is gifting more than 275 championship rings and pieces of jewelry to players, coaches, employees and others connected to the team, with a combined value above $3.7 million. A second statement on Saturday, October 24, said players were always meant to receive their rings at the opening-night ceremony and that everyone else would get theirs in roughly four to six weeks. What the fake email offered The message, whose wording circulated this week and which the company has not disputed, opened with “Congratulations, your Employee Championship Ring is here.” It promised the ring was “on the house,” made by “the same jeweler” with “the same craftsmanship,” at “No cost to you,” and offered two styles called Championship Gold and Garden Classic. As bait, it was close to perfect. The Knicks had just ended a 53-year wait for an NBA title by beating the San Antonio Spurs in the Finals, and staff across the business had reason to think they might share in the celebration. That is exactly why it stung. A test that dangles a reward employees half expect, from their own employer, in the middle of a real celebration, teaches people that good news from the company is a trap. How phishing simulations work, and what the evidence says A phishing simulation is a fake scam email sent by an organization’s own security team. It copies the tricks of real attackers: urgency, a familiar sender, a link that leads to a login page. Staff who click are usually shown a short training page on the spot, often called embedded training, and some must sit a longer course. The largest controlled study of this approach is not encouraging. Researchers at UC San Diego sent 10 different phishing campaigns to more than 19,500 UC San Diego Health employees over eight months and found that embedded training cut the chance of clicking by only 2%. About 75% of users spent a minute or less on the training material, and a third closed it straight away. Click rates also climbed with time: 10% clicked in the first month, but by month eight more than half had clicked at least one link. The same study shows why the Knicks lure worked so well. A fake Outlook password reset fooled only 1.82% of recipients, while a fake update to the hospital’s vacation policy fooled 30.8%. Put those side by side and the vacation email was roughly 17 times as effective (30.8 divided by 1.82). Messages about perks and benefits are among the hardest to resist, and a free championship ring sits firmly in that category. The researchers concluded that two-factor authentication and password managers that only fill in passwords on the correct website offer better value than more training. What to do if a too-good offer lands in your work inbox Whether the sender is a criminal or your own IT team, the right response is the same. The US Cybersecurity and Infrastructure Security Agency lists the warning signs as urgent or emotional language, requests for personal or financial details, shortened links and slightly wrong addresses. A practical routine: Check the claim another way. If HR or management is really giving out rings, bonuses or tickets, the company intranet or your manager will confirm it. Type addresses yourself instead of clicking. Look at the sender and the link. Hover over buttons before you click. A lookalike domain is the classic giveaway; spelling mistakes are less reliable now that attackers write with AI tools. Report it. Use your email program’s report button or your security team’s address. A reported test counts in your favor, and a reported real attack protects colleagues. Turn on multifactor authentication and use a password manager. Both limit the damage if a stolen password does get through, which is the scenario MSG says it already lived through. For employers, the lesson from the Garden is narrower: test the instincts that real attackers exploit, but leave promised rewards, pay and celebrations out of the bait. The real rings, MSG says, reach the rest of the Knicks organization within about four to six weeks of the October 20 ceremony. Further reading UC San Diego: Cybersecurity training programs don’t prevent employees from falling for phishing scams CISA: Recognize and Report Phishing Image: Ajay Suresh, CC BY 2.0 via Wikimedia Commons This article was produced with AI assistance and reviewed by our Editorial Desk. How we work.",
    "markdown": "https://badiyaa.com/msg-knicks-ring-phishing-test.md"
}