New York Knicks Face Criticism Over Phishing Test Disguised as Championship Ring Offer

Cybersecurity Drill Sparks Backlash

The New York Knicks and Madison Square Garden have drawn criticism following an internal cybersecurity test that used fake championship ring offers to trick employees.

Staff members received an email in late September promising complimentary NBA championship rings. Workers were invited to choose between designs like "Championship Gold" and "Garden Classic" and follow a registration link. Those who clicked the link were redirected to mandatory cybersecurity training instead of receiving memorabilia.

Context and Company Response

• The Bait: The deceptive email claimed the jewellery was made by the official manufacturer.
• The Reason: Madison Square Garden Sports acknowledged the mistake, stating that using the rings as a lure was inappropriate.
• Security Motivation: The organization pointed to a prior cyberattack involving compromised employee credentials and extortion attempts as the driver for heightened security awareness.

Reports from sports journalists indicate that the organization plans to distribute over 275 genuine commemorative items valued at more than $3.7 million to players, coaches, and select staff. However, distribution details have faced scrutiny after some assistant coaches initially received empty boxes and various arena personnel remained excluded.

Practical Implications and Verification

Organizations frequently conduct simulated phishing tests to evaluate staff vulnerability, but leveraging high-value emotional milestones like championship victories can backfire.

• Verify Announcements: Check internal communications portals or consult HR directly before clicking links related to unexpected high-value gifts.
• Look for Red Flags: Inspect sender addresses and URLs carefully for anomalies.

Original reporting on this incident stems from journalistic investigations and official statements acknowledged by Madison Square Garden.