Knicks apologize for phishing their own employees with championship ring bait

Madison Square Garden Sports has apologized for an "unfortunate mistake": an email telling New York Knicks employees they were eligible for a free championship ring, which enrolled everyone who clicked into mandatory cybersecurity training. The message was a simulated phishing attack, the company said, sent to its corporate team to strengthen defenses against hackers. The Athletic first reported the exercise.

The lure was borrowed from the company's own giveaway. MSG is distributing more than 275 rings and pieces of jewelry worth more than $3.7 million to players, coaches, employees and others in the organization. The genuine offer and the counterfeit used the same bait, in the same channel, from the same sender.

That leaves employees with one safe strategy. A click on a simulated lure earns mandatory training; a click on a real one surrenders a password. The two messages are indistinguishable by design, so the rational move is to delete both — including the offers the employer means. Every genuine message the company now sends competes with the counterfeits it commissions. MSG's statement describes the exercise as protection against hackers; the company was recently hacked and extorted after a phishing message obtained an employee's login and password. The simulation reproduced the attack that had worked, sent this time by the company itself.

NFL Network host Rich Eisen criticized Knicks owner James L. Dolan on his show. "The man is phishing his own employees with a bait of a championship ring," Eisen said. "Can you be any worse of an employer? Can you be any lower than that?"

The drill also collided with the ceremony it imitated. Ahead of the Knicks' first game of the season on Tuesday, assistant coaches were handed empty boxes at the ring ceremony, The Athletic reported — having been told earlier that day they would not receive their rings that evening, but would get them eventually.