Madison Square Garden has confirmed that an email which led employees to believe they were choosing a Knicks championship ring was a phishing simulation, calling the decision to use the rings as bait an “unfortunate mistake.” The Associated Press reported that in September 2026 MSG employees received an email reading “Congratulations, your Employee Championship Ring is here,” showing a graphic with two ring styles to select. Those who clicked the link at the bottom were sent to a mandatory cybersecurity class.
What happened
The New York Knicks won the NBA championship on Tuesday night and players received their rings before the season-opening loss to Philadelphia. The Athletic reported that assistant coaches did not get rings that night, which brought attention to the September simulation. A Madison Square Garden spokesperson said the company had sent the email to its corporate team as a simulation of a phishing attack designed to strengthen security against hackers, and confirmed that MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. The company added that more than 275 players and employees will still get their rings, and that the rings and jewelry for the Knicks family are worth more than 3.7 million dollars.
Why security teams run phishing simulations
Simulated phishing is a standard awareness tool. Security agencies including ENISA and NIST recommend it as part of a broader program, because technical defenses alone do not stop every malicious message and staff behavior decides what lands. A click on a fake lure triggers follow-up training rather than a breach. The ethical boundaries matter just as much as the exercise itself. Guidance for these campaigns says they must be authorized at the right level, that staff should not be shamed for failing, and that lures likely to cause distress are normally avoided. A celebration email about championship rings sits right at the edge of that line, and MSG has now conceded the choice was a mistake.
The part email operators should not miss
The simulation exists because MSG already knows what a real phishing click costs. The company was hacked and extorted after an employee login and password were stolen in a real phishing attack. That is the sequence every organization should keep in mind: one credential theft through email turns into an extortion event, and awareness training is the response. Training teaches people to be suspicious, but suspicion alone does not verify who an email is really from. That is the job of authentication. SPF, DKIM and DMARC prove that a message really comes from the domain it claims, and a DMARC policy at quarantine or reject stops forged mail from reaching inboxes in the first place. When your own staff and customers cannot trust the From line, every internal message becomes a potential phishing test, legitimate or not.
If your domain can still be spoofed, your employees are running their own phishing simulation every day without your permission. Excello Mail maps every legitimate sending source and takes your domains to p=reject without breaking real mail. Sign up for free to Excello Mail and make sure the only surprise emails your team receives are the ones you sent yourself.