New York Knicks Conduct Controversial Phishing Test Using Fake Championship Ring Offer

Image: Ars Technica · Source

The New York Knicks tested employee cybersecurity awareness with a phishing email promising free NBA championship rings, leading to mandatory cybersecurity training for those who clicked the link, according to reports.

In a notable example of corporate cybersecurity testing, the New York Knicks organization sent a phishing email to employees in late September promising free NBA championship rings. The email invited recipients to select between two ring designs through a provided link, claiming the ring was a complimentary reward commemorating the franchise's first NBA title in over 50 years.

This test aimed to gauge employees’ ability to detect suspicious emails that mimic legitimate company communications, a common practice among organizations seeking to improve cybersecurity awareness. However, the choice of a sentimental and potentially valuable reward—a championship ring—made this phishing exercise unusually pointed and, according to internal sources, particularly harsh.

Employees who clicked the phishing link were subsequently required to attend mandatory cybersecurity training mandated by Madison Square Garden owner James Dolan, reflecting the growing emphasis on cybersecurity within the organization.

Typically, companies design phishing tests with obvious signs that indicate a scam, such as misspelled sender domains, but the Knicks’ approach was more sophisticated. The email’s plausibility was reinforced by the fact that many NBA team employees do receive championship rings, albeit usually less ornate than those given to players.

According to senior NBA writer Joe Vardon of The Athletic, the test email featured a graphic of two different ring styles—"Championship Gold" and "Garden Classic"—and assured employees that the rings would be personalized and cost-free.

This phishing simulation coincided with a period when actual Knicks assistant coaches went onto the court for a championship banner ceremony without receiving rings, sparking internal disappointment since ring orders and customizations often take time. Some longtime Madison Square Garden staff members will not receive rings at all, underscoring the sensitive atmosphere around this gesture.

Multiple team sources confirmed the email was indeed part of a phishing test, but details such as the number of employees who engaged with the test or the possibility of eventually receiving rings remain undisclosed. Attempts to gather official comments from Madison Square Garden Sports were made but went unanswered at the time of reporting.

This incident highlights the delicate balance companies must strike between effective cybersecurity training and employee morale, especially when using emotionally charged incentives as bait in phishing simulations.