MSG calls Knicks championship ring phishing test a mistake

Key takeaways

• Madison Square Garden (MSG) used free Knicks championship rings as bait in an internal phishing test email sent to staff in late September 2026.
• On Friday, October 23, an MSG spokesperson called the ring lure "an unfortunate mistake" and said the company had recently been hacked and extorted through a similar phishing attack.
• MSG says it is giving more than 275 championship rings and pieces of jewelry, worth over $3.7 million, to players, coaches, employees and others in the organization.
• It is not yet clear which employees will receive rings or when. MSG has not given details of the earlier hack.

Knicks championship ring phishing test: what happened

Madison Square Garden called its Knicks championship ring phishing test "an unfortunate mistake" on Friday, October 23, 2026. The late-September email offered staff free rings as bait; MSG says rings will go to employees.

The Athletic first reported the story on Thursday, October 22. It said a mass email went to Knicks business-operations and arena staff in late September with the subject line "Congratulations, your Employee Championship Ring is here," according to NBC New York. The message offered two ring designs, named "Championship Gold" and "Garden Classic," at no cost to the recipient.

The offer was not real. Staff who clicked the link were told they had failed a phishing test and would have to attend a mandatory cybersecurity class, ESPN and NBC New York reported, citing The Athletic.

On Friday, October 23, an MSG spokesperson confirmed the report to Yahoo Sports, ESPN and NBC New York. The spokesperson said the email was a simulated phishing attack meant to strengthen the company's defenses against hackers, and added: "MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack." The spokesperson described the use of the rings as bait as "an unfortunate mistake."

Timeline

What we know and what we don't know yet

What we know

• The test email went to MSG's corporate team, and clickers were sent to cybersecurity training (NBC New York, ESPN).
• MSG says it was recently hacked and extorted after an employee's login details were stolen in a phishing attack (MSG statement, reported by ESPN and Yahoo Sports).
• MSG says it is handing out more than 275 rings and pieces of jewelry, valued at more than $3.7 million, to "players, coaches, employees and other members of the Knicks family," according to Yahoo Sports.
• At the October 20 ceremony, some assistant coaches received empty boxes, partly because they had not yet been fitted, The Athletic reported. An ESPN source confirmed several coaches did not receive rings that night.

What we don't know yet

• When the hack happened, what data or systems were affected, and whether any ransom was paid. MSG has not said.
• Exactly which employees will receive rings, and whether that includes everyone who got the test email. The Athletic had reported that many long-serving MSG staff, including some in Knicks business operations, were not set to receive rings.
• How many employees clicked the link.

Background

The Knicks won the 2025-26 NBA Finals against the San Antonio Spurs, ending a 53-year wait for a championship, ESPN reported. The team also won the 2025-26 NBA Cup, and a banner for each title went up at the Garden on October 20. That night's season opener against the 76ers is also covered in our report on Trump's criticism of LeBron James during the anthem.

Apart from players, each team decides who gets a championship ring. Many owners give simpler versions to staff, Yahoo Sports noted. That is why a fake ring offer was such strong bait: many employees were waiting to hear whether they would get one.

Simulated phishing emails are a common part of corporate security training. Critics have long warned that using tempting rewards, such as pay rises or bonuses, can hurt staff trust. Stolen employee logins are also behind many real breaches, as seen in recent incidents like the Capcom ID data breach, the Quest Diagnostics Quanum breach and the State Bank of India cyberattack.

What it means

For MSG, the episode turned a routine security exercise into a public relations problem in the week of the Knicks' ring celebration. MSG now says employees will receive rings, which may ease some of the anger, but it has not given a list or a timeline.

For other companies, the story shows a balance that security teams have to strike. Realistic phishing tests help train staff, and MSG says it was itself breached through a phishing email. But lures built around things employees really want, such as rewards from their own employer, can backfire. Stronger sign-in protection, such as passkeys and password managers (see our report on 1Password's new login approach), reduces the damage when a password is stolen.

We will update this story if MSG gives details about the hack or ring distribution.

Sources

• Yahoo Sports: Knicks call plan to use fake championship rings as employee phishing test "an unfortunate mistake"
• ESPN: Phishing email to Knicks employees an "unfortunate mistake," MSG spokesman says
• NBC New York: Knicks employees offered championship rings in phishing test email
• CBS Sports: Knicks reportedly duped employees with championship ring email that was actually a phishing test