Knicks Championship-Ring Email Was a Phishing Test — and It Backfired

In late September 2026, Madison Square Garden sent a mass internal email that read like a real perk: a complimentary employee championship ring for the Knicks’ first NBA title in more than 50 years, with a choice between two designs. Employees who clicked the link were told they had failed a phishing simulation and were routed into mandatory cybersecurity training — not a jeweler’s order form.

After the story broke in October 2026, MSG Sports called using championship rings as the lure “an unfortunate mistake.” The company said it had sent the message as a simulated phishing attack to strengthen defenses after ShinyHunters extortion that reporting tied to credentials obtained through phishing (MSG / Knicks breach coverage). MSG also said it would still gift more than 275 championship rings and jewelry, worth more than $3.7 million, to players, coaches, employees, and other members of the Knicks organization.

For Texas small businesses, law firms, financial advisors, and local governments running security awareness programs, the lesson is not “never phish-test.” It is that reward, bonus, and HR-benefit lures can train click habits while damaging trust — even when the underlying goal (fewer real phish clicks) is right. Real criminals do use those themes. Pair simulations with phishing-resistant MFA, DMARC enforcement, and a culture that rewards reporting, not only punishing clicks.

Snapshot

What happened

Reporting from The Athletic (Oct 23, 2026), NBC New York, AP, USA Today, and Ars Technica converges on this timeline:

1. Late September — MSG emailed a long list of employees with ring graphics and copy paraphrased below (no individual employee names in this article).
2. Recipients who clicked were told the offer was a phishing exercise and were required to complete security training.
3. Oct 20, 2026 — The Knicks held a championship ring ceremony at the Garden; players received rings. Reporting noted some assistant coaches received empty ring boxes that night because sizing and production were still in progress — a separate logistics story from the phishing test, but it fed public confusion about who would actually receive jewelry.
4. Oct 23–24, 2026 — After The Athletic’s story spread, MSG Sports issued a statement calling the ring lure a mistake and reaffirming plans to distribute rings and jewelry broadly.

Paraphrased lure language (The Athletic / NBC, Oct 2026): the subject line congratulated the recipient on an employee championship ring; the body said MSG was issuing a complimentary ring, personalized with your name, no cost to you, with two styles to reserve via a link below.

What MSG said publicly: the email was “a simulation of a phishing attack designed to strengthen our security against hackers.” MSG tied the exercise to recent hacking and extortion using employee credentials obtained through a similar phishing attack. Using rings to grab attention was “an unfortunate mistake.” The organization would still gift more than 275 rings and jewelry worth more than $3.7 million (NBC New York).

Still unclear from public sources: who approved the template, whether the message used a misspelled domain or other classic “tell,” how many employees clicked, and how many staff were on the distribution list. BroBible and other outlets amplified the story; we relied on AP, The Athletic, and MSG’s statement for core facts.

Why reward lures backfire

Phishing simulations work when they teach skepticism without teaching cynicism toward your own employer.

Reward and HR-benefit themes are double-edged:

• Real attackers use them. Bonus payouts, payroll corrections, gift cards, benefits enrollment, and “free” merchandise show up constantly in BEC and credential-harvesting campaigns — the same class of mail that preceded the MSG ShinyHunters incident.
• They exploit goodwill. After a genuine championship, a believable ring offer is emotionally charged. Employees who clicked may have been excited, not careless.
• Punish-only framing erodes the security program. Mandatory training after a cruel surprise can read as HR trickery, not coaching. That makes the next real phish harder to report.
• Leadership trust matters. Small Texas firms and local governments already ask staff to forward suspicious mail. Fake raises, stimulus, or benefit lures from “the boss” burn political capital fast.

None of that means stop training. It means choose lures that match ethics, disclose the program’s existence, and measure reporting — not only failures.

How to run a fair phishing test

Practices that fit a 20-person CPA firm or a county clerk’s office as well as a arena operator:

1. Policy first. Publish a written security-awareness plan: what you simulate, how often, and that tests will never promise cash, benefits, or merchandise you do not intend to deliver.
2. No fake bonuses, raises, or gifts. Use mundane lures — password expiry, shared file, shipping notice — or clearly labeled training domains. If you must simulate executive mail, use obvious training markers your policy describes.
3. Teach, don’t humiliate. Clickers get coaching, not public scoreboards. Prefer micro-lessons at click-time that explain what was suspicious.
4. Reward reports. Track “report phish” button use and thank people who escalate. Some platforms let you gamify reporting, not only failure rates.
5. Leadership sign-off. HR and legal should approve wording for any lure touching compensation or benefits — especially in union or public-sector environments.
6. Align with real controls. Simulations complement DMARC, MFA, and mail filtering — they do not replace them.

What to do (technical controls)

1. Enforce DMARC at reject (with aligned SPF/DKIM) on domains you send from — and monitor lookalikes (table below).
2. Deploy phishing-resistant MFA (FIDO2 / YubiKey-class keys) for Microsoft 365, Google Workspace, and any remote admin paths — the same identity planes MSG reporting tied to its 2026 breach entry.
3. Enable anti-phish links in your mail platform and disable legacy auth where possible.
4. Run simulations, but ban reward/benefit bait unless leadership explicitly accepts the morale risk — and document that decision.
5. Tabletop the “we were hacked” scenario with comms and IT: how you tell staff about real incidents without sounding like the next fake test.

MFA: YubiKey and Google Authenticator

A phishing-resistant key on Microsoft 365 or Google Workspace would not have stopped employees from clicking a fake ring link, but it does reduce account takeover when a separate credential phish succeeds — the chain described in MSG breach reporting. Grades follow our MFA directory.

Microsoft documents FIDO2 security keys and authenticator apps for work accounts (Microsoft Learn — passkeys and security keys). Google Workspace admin documentation describes security keys and Google Authenticator-class TOTP (Google Workspace admin — 2-Step Verification). KnowBe4 learner help names Google Authenticator, Authy, and LastPass; it does not document a native YubiKey path — Pass, not Strong (KnowBe4 learner MFA help).

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We re-audited msg.com and msgsports.com on November 1, 2026. 100% is the ideal — neither reaches it. These scores measure public email identity, transport, and website posture. They do not grade whether an internal phishing template was ethical, and they do not prove who sent the September test.

Audit links: msg.com · msgsports.com

Weak Transport (15%) on both domains is a reminder that inbound mail authentication for customer-facing properties still lags — relevant when attackers impersonate ticketing, VIP, or HR themes after a high-profile season. An older July 2026 MSG sports breach audit snapshot showed different category numbers; use today’s links for current posture.

Blacklist and lookalike domains

Email blacklist checks (public DoH, November 1, 2026): msg.com and msgsports.com were clear (0 mail/domain hits on checked lists).

Cybersquat scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this simulation used them):

Type msg.com and msgsports.com yourself. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• MSG Sports breach and domain audits (July 2026)
• ShinyHunters MSG / Knicks data leak (June 2026)
• Google redirect trust-proxy phishing — reward-themed work mail
• MFA support directory

Check your domain free at audit.emailmenow.com, or see automated reports and monitoring.

Sources: Associated Press (Oct 2026) · The Athletic / NYT (Oct 23, 2026) · NBC New York (Oct 2026) · USA Today (Oct 24, 2026) · Ars Technica (Oct 2026) · BroBible (Oct 2026) · Houston Chronicle · Microsoft Learn — authentication methods · Google Workspace — 2-Step Verification · KnowBe4 — MFA · Independent EmailMeNow audits, blacklist, and cybersquat probes November 1, 2026. Domain scores: audit.emailmenow.com only.