What We Know About the Knicks' Fake Championship Ring Phishing Test

The New York Knicks organization sent staff a fake offer of free championship rings as part of a corporate phishing test, according to a report by Ars Technica that cites a New York Times account of the email. The message went to Madison Square Garden employees in late September, roughly three months after the Knicks' NBA title win on June 13, 2026, and told recipients, "Congratulations, your Employee Championship Ring is here," before asking them to click a link and pick from two ring designs.

What did the test actually measure?

The exercise followed a standard corporate security method: send a message mimicking a desirable internal communication, then track who clicks. Companies commonly use a slightly altered sender domain as the tell; Ars Technica noted its own owner, Condé Nast, runs similar drills from a misspelled "condenest.com" address. Ars Technica reported it does not know whether the Knicks' email contained an equivalent spelling tell, so the specific detection cue used in this test remains unconfirmed.

What happened to employees who clicked the link?

Staff who clicked the ring-selection link were required to attend a mandatory cybersecurity class, according to team sources cited in the report. The training was described as tied to owner James Dolan's broader cybersecurity concerns. Dolan owns the Knicks, the New York Rangers, and Madison Square Garden.

By the numbers

• 2: ring designs the fake email let recipients choose between.
• 1973: the last year the Knicks won an NBA championship before 2026, per the report.

Why did the fake offer land so hard?

The test's design exploited a plausible real-world expectation. Joe Vardon, senior NBA writer for The Athletic, wrote that "typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive." That baseline expectation is part of why Ars Technica's writeup called the test "especially cruel": the prize dangled wasn't an implausible lure, since real championship rings for MSG staff were already an open question at the time.

Did real rings end up getting delayed too?

Yes, separately from the phishing test. Vardon's reporting, relayed by Ars Technica, found that Knicks assistant coaches were handed empty boxes on the night the team raised its championship banner, with rings expected later. Vardon attributed the delay to ordering, design, and measurement timelines that do not always align with banner night for defending champions. He also reported that some longtime Madison Square Garden employees, including some in the Knicks' business operations, will not receive rings at all, according to team sources.

How common are phishing tests like this one?

Sending simulated scam emails to employees is a routine corporate security practice used to identify staff who need additional training, and most large organizations run some version of it. What distinguishes the Knicks case, per the report, is the subject matter: a championship-starved fan base's own staff being baited with a symbol of the title itself.

What is still unknown?

Ars Technica's report does not specify what percentage of Madison Square Garden employees clicked the phishing link, how many total employees received the test email, or whether the email contained visible red flags beyond its content. The Knicks organization's own comment on the test, if any, was not included in the available reporting.

Read the original report at Ars Technica.