Madison Square Garden has acknowledged a mistake in a cybersecurity exercise that used New York Knicks championship rings to attract employees’ attention. An email appeared to invite staff to choose a ring, but clicking its link instead led to mandatory security training. The company said the exercise was intended to prepare employees for phishing attacks, according to an Associated Press report published by The Globe and Mail on October 23, 2026.
MSG also said that more than 275 players, coaches, employees and other members of the Knicks family would receive championship rings and jewelry as planned, gifts it valued at more than $3.7 million. The assurance drew an important line: the email was a simulation, while the company’s recognition program was real.
What employees received
The Athletic reported that MSG employees received the message in September. It announced, “Congratulations, your Employee Championship Ring is here.” A graphic showed two ring styles, giving recipients what looked like a choice connected to the team’s championship celebrations. Employees who followed the link at the bottom were required to attend a cybersecurity class rather than complete a ring selection.
Knicks players received their championship rings on Tuesday, October 20, before their season-opening loss to Philadelphia. An Associated Press photograph by Frank Franklin II showed Jalen Brunson displaying his ring to his father, Rick Brunson, before that game in New York. The Athletic’s Thursday report said assistant coaches did not receive rings that night. That report about the ceremony and the account of the employee email were separate parts of the story.
Why MSG ran the exercise
A Madison Square Garden spokesperson said the company had previously sent its corporate team a simulated phishing email to strengthen its defenses against hackers. The spokesperson also said MSG had recently been hacked and extorted after an employee login and password were obtained through a similar phishing attack. The statement did not provide further details about that incident.
The company described using championship rings as the lure as an “unfortunate mistake.” Its explanation identified a genuine security concern while acknowledging that the particular invitation had been a poor choice. The ring gifts, it said, were intended to recognize contributions to the championship and celebrate the achievement.
How a phishing simulation works
A simulated phishing message imitates the kind of unexpected email an attacker might send. Instead of stealing credentials or installing malicious software, a company-controlled exercise can direct a recipient to training. The resemblance to an ordinary workplace message is part of the test: an attractive offer or familiar subject can make a link seem less suspicious.
That explains the mechanism, but it does not establish how MSG designed or evaluated this particular exercise. The published account does not say how many employees clicked, whether anyone entered credentials, or what the required class covered. Those details should not be assumed from the fact that training followed a click.
For employees faced with a similar message, a practical check is to confirm the offer through a known internal channel before using an unexpected link. Looking at the full sender address and checking where a link leads can help, but a familiar logo or an appealing subject does not by itself verify a message. An employee can contact an established help desk or manager without replying to the questionable email.
A security lesson amid a celebration
Here, the subject of the exercise was unusually personal to the workplace. A championship ring represents recognition for a shared accomplishment, so an invitation to choose one carries a different expectation from a routine administrative notice. The reported sequence shows why the training device and the recognition program needed to be clearly distinguished.
MSG’s Friday statement confirmed that distinction without supplying a full distribution schedule for every recipient. What it did say was that the planned rings and jewelry would still be given out. The original reporting comes from the Associated Press account published by The Globe and Mail.
