Madison Square Garden employees received emails teasing the possibility of finally receiving New York Knicks championship rings, but the messages turned out to be part of an internal phishing test. Employees who clicked the links to claim their supposed rings were required to attend cybersecurity training.

The emails played on the Knicks’ decades-long wait for another NBA championship, using the prospect of a long-awaited title as bait to encourage employees to open the links. Rather than receiving a championship ring, workers who took the bait faced additional training on recognizing suspicious emails and avoiding potential cyber threats.

The Knicks have not won an NBA championship since 1973, when they defeated the Los Angeles Lakers in the NBA Finals to secure the second title in franchise history. The team also won the championship in 1970, but its subsequent decades without another title have made a championship run a recurring source of anticipation among its fan base.

That history gave the fake emails a recognizable hook, particularly for employees who follow the team or work within the organization that operates Madison Square Garden. The promise of a commemorative ring tied to a championship would have been an appealing prospect for some recipients, even though the offer was not legitimate.

Phishing simulations are commonly used by companies to test whether employees can recognize deceptive messages that imitate legitimate communications. Such emails may offer rewards, request account information, or create a sense of urgency to persuade recipients to click a link or provide sensitive information.

The exercises are designed to identify employees who may need additional instruction before they encounter genuine cyberattacks. Clicking a link in a simulated phishing message can trigger follow-up training on warning signs, including suspicious web addresses, unexpected offers, and requests that should be verified through official channels.

For Madison Square Garden employees who clicked the links, the fake championship celebration became a cybersecurity lesson instead. The episode also demonstrated how familiar workplace interests and major sporting events can be used to make phishing attempts more convincing.