# New York Knicks Face Backlash Over Phishing Test Using Championship Rings Madison Square Garden admits using championship memorabilia as a phishing lure was inappropriate. - **Source:** [Latest from TechRadar](https://www.techradar.com/feeds.xml) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d9b180fc-1620-41cc-9a2b-212e8ad8d045 ## Deceptive Security Assessment The New York Knicks conducted an internal phishing test by emailing employees with a fake offer for championship rings. Staff members were prompted to select between two designs, Championship Gold or Garden Classic, via a link. Those who clicked the link were redirected to mandatory cybersecurity training instead of receiving the promised commemorative jewellery. ## Exploiting Team Success The timing of the exercise coincided with the franchise's first NBA championship since 1973. Because NBA organizations frequently distribute commemorative items to non-playing staff, employees reasonably expected the offer to be genuine. Madison Square Garden Sports later acknowledged that using such high-value emotional bait was an inappropriate method for testing employee vigilance. ## Root Cause Analysis The organization initiated this aggressive testing strategy following a previous cyberattack where employee credentials were compromised. Hackers had successfully used fraudulent communications to gain unauthorized access to company systems and extort the organization. This incident forced management to prioritize employee awareness through simulated threats to prevent future credential harvesting and system breaches. ## Verification of the Exercise Joe Vardon, a senior journalist at The Athletic, confirmed the exercise's purpose through multiple sources familiar with the situation. While the specific indicators of the phishing attempt, such as suspicious sender addresses or misleading URLs, were not disclosed, the test successfully identified workers susceptible to fraudulent messages and credential theft within the organization. ## Jewellery Distribution Logistics Madison Square Garden plans to distribute over 275 commemorative items, including rings and jewellery, valued at more than $3.7 million. These gifts are intended for players, coaches, and select staff. However, the distribution process has faced scrutiny after assistant coaches initially received empty presentation boxes, leaving many long-time business personnel excluded from the rewards. ## Organizational Response Madison Square Garden Sports issued an official statement admitting the mistake regarding the phishing lure. The company recognized that leveraging the championship rings to gain employee attention was an unfortunate error in judgment. Despite the apology, the organization has not specified how many employees were affected by the test or the total count of recipients. ## Security Training Mandates Employees who interacted with the deceptive link were immediately assigned compulsory cybersecurity lessons. This mechanism aims to reinforce defensive behaviors against real-world phishing attempts. The organization remains focused on improving internal security protocols, although the method used to identify vulnerable staff members has sparked significant criticism regarding internal communication and workplace trust. ## Balancing Security and Morale The incident highlights the tension between maintaining robust cybersecurity and preserving positive organizational culture. While phishing simulations are standard industry practice for mitigating credential theft, using highly anticipated rewards as bait can damage employee morale. Organizations must balance the necessity of rigorous security testing with the potential impact on staff engagement and trust. ## Sources covering this story - https://www.techradar.com/pro/new-york-knicks-slammed-after-offering-employees-nba-championship-rings-in-what-turned-out-to-be-a-phishing-test — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._