Knicks Call It an 'Unfortunate Mistake' After Employees Were Phished With Fake Championship Rings

TL;DR: Madison Square Garden admits it was an “unfortunate mistake” to use championship rings as the lure in a September phishing test after The Athletic revealed Knicks assistant coaches were handed empty ring boxes on ring night. MSG says it was recently hacked and extorted through a similar phishing attack, and that 275+ rings worth over $3.7 million are still going to players, coaches and employees.

A 53-year wait for a championship, and the punchline is a phishing test.

On Tuesday night at Madison Square Garden, the Knicks raised a banner and players were presented one by one with the rings they earned by beating San Antonio in five games in the 2026 Finals. Assistant coaches were handed boxes too — boxes that were empty. The Athletic’s Joe Vardon broke the story Thursday: the coaches would get their rings at an unspecified later date, and separately, longtime MSG employees had been told they would not get rings at all, despite a September email inviting them to pick out their “Employee Championship Ring.”

What was in the email?

A trap, beautifully designed. Per the AP’s Friday report, the September email to MSG’s corporate team read: “Congratulations, your Employee Championship Ring is here.” It included a graphic showing two ring styles that recipients could supposedly select. Anyone who clicked the link or responded was shunted into a mandatory cybersecurity class. The bait was perfect because it was true-adjacent: after half a century without a title, the building was full of people who had waited their whole careers for exactly that email. Which is precisely why MSG’s apology landed as it did.

What did MSG say?

The company acknowledged the whole thing in a Friday statement and called the lure choice an “unfortunate mistake.” “The company had previously sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers,” an MSG spokesperson said. Then came the disclosure that changes the story’s register: “MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack.” The test, in other words, was not a prank — it was a trauma response. The company still picked the worst possible lure for it: dangling the thing 275 people in the building had just earned after 53 years, then punishing the believers with remedial training.

What did clicking the link cost employees?

An afternoon of their dignity, plus a class. Anyone who clicked the September email’s link or replied to it was routed into a mandatory cybersecurity training session, per the AP and USA Today accounts. The logic of a phishing simulation is that failure teaches; the logic of this one is that failure followed belief in something genuinely plausible. After 53 years without a title, employees were asked to treat the best news of their working lives as a suspicious link. The training they were sent to was presumably excellent. The lesson they took home was that the company uses its greatest achievement as bait.

How did MSG explain the empty boxes?

With a raincheck. The Athletic reported Thursday that assistant coaches, handed empty boxes during Tuesday’s on-court presentations, were told they would receive their rings at an unspecified later date — the illusion of a ring without the ring. The same report said many longtime MSG employees had been informed they would not be receiving rings at all. MSG’s Friday statement answers both at once: more than 275 championship rings and jewelry pieces, worth over $3.7 million, are being gifted to “players, coaches, employees and other members of the Knicks family.” The giveaway number is generous. The timeline for the people who held the empty boxes remains, at the time of writing, unspecified.

So who is getting rings?

Everyone, per the statement. “The company is gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.” The giveaway proceeds as planned. The damage, though, is not about jewelry; it is about the sequence. Tuesday’s ceremony — the banner, the individual presentations, the on-court moment — played out in front of assistant coaches holding empty boxes, weeks after the same employees had learned that “your championship ring is here” was corporate-speak for “you failed a test.” The Knicks’ title summer was supposed to be the feel-good story of the league, and the preseason already had its own noise. Now the franchise’s signature achievement comes with an asterisk nobody on the roster created — and a cybersecurity lesson the staff will not forget, for all the wrong reasons. In a season where the league is already scrutinising the tech inside its own equipment, the Knicks’ biggest breach turned out to be an email.