In September, a long list of Madison Square Garden employees got an email that read, "Congratulations, your Employee Championship Ring is here." The Knicks had just won their first title in 53 years, and the email offered a free ring in a choice of two designs. It was a phishing test. MSG's security staff sent it, and everyone who clicked had to take a mandatory cybersecurity class. The Athletic's Joe Vardon broke the story Thursday. Team sources told him MSG ran the test to ease Knicks owner James Dolan's worries about hacking. In their words, it was meant to "help satisfy some of Dolan's growing cybersecurity concerns." Vardon also reported that many longtime MSG employees won't get a ring at all. At Tuesday's ring night, the team handed its assistant coaches empty ring boxes. An MSG Sports spokesperson told The Athletic, "We are not disclosing anything about the rings."

1. Real Scammers Would Use This Exact Bait (Test Defenders and Security Analysts)

Defenders say the bait had to be believable, because that's what a phishing test is for.

A phishing test only works if the fake email is tempting. Testers want to see who clicks. A free championship ring fit that bill. Some commenters defending the test called it standard practice that companies run all the time. Research shows why tempting bait matters. In one big study at a university health system, a fake vacation-policy email fooled almost 31% of the employees who got it, while a fake password update fooled under 2%.

Criminals won't be polite about it. After a similar fight in 2020, analysts at the research firm Forrester laid out the defenders' case: attackers "are not above using the very same tactics." The training company NINJIO tells clients the same thing in its 2026 guide, under a heading that reads "Phishing Simulations Must Test Emotional Manipulation." By that logic, a fake ring email is exactly what a real scammer would send right after a title.

MSG has real reason to worry about hackers. In June, the hacking group ShinyHunters began publishing data it said it stole from MSG, 404 Media reported. The leak included a "talent" list with former Knicks players and coaches. No report has tied the breach to the ring test.

2. But Dangling a Ring Employees Won't Get Is Cruel (Sports Writers and the Training Industry)

Critics say MSG used a prize many employees will never receive as bait.

The bait was a prize many won't get. CBS Sports NBA writer Sam Quinn wrote on X that "teasing employees with information about rings they earned but may not receive is unnecessarily cruel." The assistant coaches who got empty boxes reacted with everything "from genuine anger to annoyance," The Athletic reported. To be fair, the Thunder also held back assistants' rings on their ring night in 2025.

Companies that tried this before ended up apologizing. In 2020, GoDaddy emailed employees a fake $650 holiday bonus, then told the roughly 500 who clicked, "you failed our recent phishing test." GoDaddy apologized and said it needed to "be more sensitive to our employees." Tribune Publishing ran a fake-bonus test the same year during furloughs and pay cuts, and apologized too. The Chicago Tribune's union president, Megan Crepeau, called it "beyond insulting."

Even the people who sell these tests draw a line here. The training firm Hoxhunt warns that bonus-style lures feel "manipulative and personal" and hurt trust. Hoxhunt puts it bluntly: "No 'cruel realism.' If it would be devastating in real life, it doesn't belong in a test."

3. And the Class Probably Won't Stop Anyone From Clicking (Phishing Researchers)

What UC San Diego calls the largest study of anti-phishing training found it barely changes anything.

Researchers say phishing training barely works. Researchers at UC San Diego ran an eight-month experiment on more than 19,500 UC San Diego Health employees. Recent annual security training made no real difference in who clicked. The quick lessons people saw after clicking cut the chance of clicking a phishing link by only about 2%. Three-quarters of employees spent a minute or less on those lessons, and a third closed the page right away.

They'd rather fix the tech. Ariana Mirian, a coauthor who later joined the security firm Censys, said the results suggest "these trainings, in their current form, are not effective." The authors recommend two-factor logins and password managers instead. If they're right, MSG risked its staff's goodwill for a class that likely won't make anyone much safer.

Where This Lands

Defenders of the test say a phishing drill only works if the bait is believable, and a free ring was believable bait. Critics say using a prize many employees won't receive crosses a line that even phishing-training companies tell clients to respect. The research suggests the mandatory class at the end likely won't change much either way. MSG still isn't saying who gets a ring.

Sources