Knicks Phishing Test: What the Fake Ring Email Teaches

The Knicks phishing test is the weirdest ring story of the week. Madison Square Garden sent staff an email that said “Congratulations, your Employee Championship Ring is here,” and it was a trap. The Athletic reported it on Thursday, and ABC7 and Yahoo Sports followed up. I read all three, plus MSG’s own statement, because I wanted to know what actually happened and what the rest of us can take from it.

Short answer: the ring offer was fake, the company says it was a security drill, and the company now calls the choice of bait “an unfortunate mistake.” The useful part for you is how that email worked, so I’ll go through it line by line.

What happened in the Knicks phishing test

At the end of September, a long list of MSG employees got an email with a picture of two ring designs. It offered a free, personalized championship ring after the Knicks won their first title in 53 years. Employees who clicked the link at the bottom did not get a ring. Instead, they landed on a message saying they had failed a phishing test, and they had to sit through a mandatory cybersecurity class.

Meanwhile, the real ring night came a few weeks later, on Tuesday, October 20. So rings were already on everyone’s mind.

When	What happened
Late September	MSG employees get the “Employee Championship Ring is here” email
Tuesday, October 20	Knicks ring and banner night at Madison Square Garden
Thursday, October 22	The Athletic reports the email was a phishing test
October 23 and 24	Yahoo Sports and ABC7 repeat the story and carry MSG’s statement

One thing I couldn’t find anywhere is how many people clicked. The Athletic says “some number” did, and nobody has given a figure.

What MSG said about the Knicks phishing test

An MSG Sports spokesperson put out a statement, which ABC7 quoted. It said the company had sent the email “as a simulation of a phishing attack designed to strengthen our security against hackers.” The same statement adds: “Using the rings as a lure to gain employees attention was an unfortunate mistake.”

The company also said it is “gifting more than 275 championship rings and jewelry” to players, coaches, employees and others, worth more than $3.7 million. That may change the original report that many employees would get no ring at all, but I only have the statement, not a list of who gets one.

Also worth knowing: The Athletic got its details from team sources who asked not to be named. MSG confirmed the simulation, but the statement I saw gives no number for how many employees clicked. Treat the details beyond the statement as reported, not official.

Why the Knicks phishing test email worked

I’d call this a well-built lure. In the parts of the email that were quoted, nothing asks for a password or tells anyone to hurry. Instead, it leans on the one thing a whole building of Knicks employees wanted to hear.

The four lines that did the work

• Good news first. “Congratulations, your Employee Championship Ring is here.” The team had just won, so people were already happy and expecting something.
• Free. “This one is on the house… No cost to you.” When something costs nothing, most of us skip the step where we check with someone.
• Personal. “The same jeweler, the same craftsmanship, personalized with your name.” A name in the message makes it feel like it came from someone who knows you.
• A choice to make. “Reserve the one you want below.” Picking between Championship Gold and Garden Classic feels like a small, fun task, and the link is how you do it.

None of that matches the classic warning signs, like threats or bad spelling. In fact, CISA’s guidance says perfect grammar no longer proves a message is real, and it tells people not to click links or attachments that seem too good to be true. A free diamond ring is a pretty good example.

Why the Knicks phishing test hit a nerve

I understand why MSG ran a test. A drill with a believable prize is closer to what real criminals send. But I also get why staff are annoyed, because the bait was something many of them really wanted and some reportedly won’t get.

This has happened before, and it usually goes the same way. In 2022, Oregon Health & Science University sent a fake $7,500 pandemic benefit email as a test. The university apologized after complaints and said, “That was a mistake,” since the wording had come from a real scam. In 2023, the UK law firm Knights sent a fake “Salary increase” email right after pay reviews with tiny raises, and Graham Cluley’s write-up says RollOnFriday described it as going down “like a lead balloon.”

Overall, my take is that the test itself was fine and the prize was the problem. Scammers don’t care how you feel when the email ends, but your employer has to work with you the next day. A package-delivery notice or a shared-document request would have taught the same lesson without taking away a ring.

The real MSG breach in June

The statement also says MSG “was recently hacked and extorted using an employee login and password obtained through a similar phishing attack.” That matches a June incident. Have I Been Pwned lists a Madison Square Garden Sports breach added on June 24, 2026, covering about 9.8 million unique email addresses from staff and customers, in what it calls a “pay or leak” extortion campaign by the ShinyHunters group.

However, the way in is described differently elsewhere. 404 Media reported that the hackers “called a low level employee and tricked them” into giving access, which is voice phishing, not an email. I can’t tell you which account is complete. Still, it’s a good reminder that a fake call can work just as well as a fake email, so treat both the same way.

If you want another recent example of a breach and what to do next, I wrote about the Crime Stoppers data breach earlier this week.

How to handle a free-perk email at work

Most workplaces will send something like this sooner or later: a bonus, a gift card, a free item, a survey with a prize. Here is what I would do each time.

• Stop on anything that is free, urgent, or addressed to you by name. Those are the three things scammers lean on.
• Skip the link in the message. Instead, open your company’s intranet or ask HR or IT through a channel you already use.
• Check the sender’s address and hover over the link to see where it really goes.
• Report it with your mail app’s report button, even when you’re not sure. CISA says reporting helps protect other people too.
• Treat phone calls and texts the same way. If someone calls asking for a login, hang up and call back on a number you already have.

If you already clicked

This part is general security advice, not something from the Knicks reporting. First, don’t type anything into the page that opens. Then close it and tell your IT or security team right away, because early reports give them time to check your account.

If you did enter a password, change it at once, on the real site, from a device you trust. Also turn on two-step sign-in wherever you can, since a stolen password alone won’t get a criminal in. A quick report is far better than hoping nobody notices. In fact, that is exactly what a good phishing test is meant to teach.