Knicks' parent calls ring-bait phishing test an 'unfortunate mistake'

The Knicks organization sent its employees an email offering free championship rings. It turned out to be a test. The New York Times reported that the message was a phishing-test email promising free rings.

The team's parent company now says that was a bad idea. Madison Square Garden Sports called the use of rings as bait a regrettable error.

Key facts

• The fake email was sent in late September and asked staff to click a link to pick a ring design.
• Employees who clicked had to attend a mandatory cybersecurity class, according to the report.
• MSG said it was recently hacked and extorted after a similar phishing attack gave someone an employee's login.
• MSG says it is gifting more than 275 rings and other jewelry valued above $3.7 million.
• It is not clear how many employees clicked the link.

What the email said

The message looked like good news. It congratulated staff on their employee ring and asked employees to click a link to pick one of two ring designs.

The two options were called Championship Gold and Garden Classic. The email also said the ring would be free.

Clicking had a cost of its own. Employees who followed the link were required to take a mandatory cybersecurity class, according to the report.

Multiple team sources confirmed that the email was a phishing test, The Athletic's Joe Vardon wrote.

Why MSG ran the test

MSG pointed to its own recent trouble. The company said it was hacked and extorted using an employee login and password that was stolen through a similar phishing attack. Details of that earlier hack have not been made public.

Still, the company said the ring offer went too far. "Using the rings as a lure to gain employees' attention was an unfortunate mistake," MSG said in a statement.

The real rings

The test came during a big moment for the team. The Knicks raised their first league championship banner since 1973 on Tuesday.

Many people will get real rings. MSG said it would give out more than 275 rings plus other jewelry, valued at more than $3.7 million, for players, coaches, staff and others.

Not everyone has one yet. Knicks assistant coaches were handed empty boxes at the ring ceremony and told rings would come later.

Others may not get one at all. Many longtime MSG employees, including some in Knicks business operations, will not receive rings, team sources told The Athletic. That clashes with the fake email's message that staff rings had arrived. How many employees will eventually get rings is not known.

Background

Phishing tests are common at companies. Firms send them to find employees who miss signs that a message is a scam.

Real phishing messages work in a similar way. The FTC says they often tell a story to get people to click a link or open an attachment.

James Dolan owns the Knicks, the New York Rangers and Madison Square Garden.

Who is affected

The test was aimed at MSG corporate staff. Those who clicked were sent to mandatory cybersecurity training. It is not clear how many people that included.

The ring giveaway itself has left some staff out. Assistant coaches received empty boxes at the ceremony, and many longtime employees will not get rings, team sources told The Athletic.

What it means for you

The case shows how phishing can work. The fake email offered a prize and asked for a quick click, and the FTC says scam messages often use a story to draw people in.

A message from a known employer can still be a trap. MSG's own hack began with a similar phishing attack, the company said.

Practical steps

• Report phishing emails. The FTC says to forward them to the Anti-Phishing Working Group at [email protected].
• Report phishing texts. The FTC says suspicious texts can be forwarded to SPAM.
• Pause before clicking. The FTC notes that phishing messages often tell a story to prompt a click or get someone to open an attachment.

What happens next

The Knicks assistant coaches were told they would receive their rings eventually. No date has been given.

FAQ

What did the fake email offer? It offered a free employee championship ring in one of two designs, with a link to reserve one.

Why did MSG run the test? MSG said it was recently hacked and extorted using login details stolen through a similar phishing attack.

What happened to employees who clicked? They had to attend a mandatory cybersecurity class.

How many rings is MSG giving out? MSG says it is giving more than 275 rings and other jewelry valued above $3.7 million.

How many employees fell for the test? That is not clear.

What did the assistant coaches receive? They were handed empty boxes at the ceremony and told rings would follow.

When did the Knicks last raise a title banner before this? Tuesday's banner was the team's first league championship banner since 1973.

Who confirmed the email was a test? Multiple team sources confirmed it was a phishing test, The Athletic's Joe Vardon wrote.

Who owns the Knicks? James Dolan owns the Knicks, the Rangers and Madison Square Garden.

How can people report a phishing email? The FTC says to forward it to [email protected].

Will all employees get real rings? No. Team sources told The Athletic that many longtime employees will not receive rings.