A phishing email tricked Knicks staff into thinking they'd get championship rings

Sometimes, cybersecurity threats don't just spoil a person's day — they spoil a sports team's greatest moment. Some New York Knicks and Madison Square Garden (MSG) employees were fooled into clicking through a phishing email test that promised 2026 championship rings.

Knicks sources speaking to The Athletic say MSG sent a phishing test that offered workers reservations for one of two free rings. If they clicked, they were reportedly required to attend a security class that assuaged some of team owner James Dolan's concerns digital dangers.

If there's any consolation, it's that more diligent staff aren't faring much better. The insiders claim "many" MSG and Knicks employees aren't getting rings at all, breaking a common practice for NBA teams.

Even key team members aren't immune. While Knicks president Leon Rose received his ring during ring night, the assistant coaches only got empty boxes. This isn't unheard of, and is unsurprising when the coaches apparently weren't measured for their rings in time. Teams like the Clevaland Cavaliers and Los Angeles Lakers did hand out rings, however.

An MSG representative tells The Athletic the arena is "not disclosing anything" regarding the rings.

How can I protect myself against phishing scams?

Don't just look for plausible messages

It's easy to spot some phishing attempts, such as requests to send money or shady login warnings. However, the Knicks incident makes clear that some attacks can be far subtler.

To start, don't just assume that a credible-looking message is authentic. If you're promised something or urged to take immediate action, check that the sender's email address (or info, if it's a text) is real and verify any link addresses. Phishers frequently use bogus accounts and web domains that might mention a company's name, but are obviously unofficial when you pay attention.

Some perpetrators clone real email addresses, so it's vital to scan an entire message.

This includes messages that include personal references, such as your family members or location. Hackers sometimes use info from data breaches to impersonate your loved ones or favorite stores. If you weren't expecting someone to reach out, even if they're familiar, it's important to be skeptical and double-check that emails and texts are legitimate.