The New York Knicks won their first NBA title since 1973 last season, turning Manhattan into a weekslong party and giving Madison Square Garden another reason to lean into its status as the “Mecca of Basketball.” But as the Garden, which is run by Knicks owner James Dolan through Madison Square Garden Sports and related MSG companies, prepared to celebrate the title, some employees received a phishing email test that has drawn criticism from sports commentators and raised broader questions about how companies should test employees’ cybersecurity awareness.
According to The Athletic, the email, which the publication obtained, congratulated recipients on their supposed employee championship rings and offered them a choice between two designs: “Championship Gold” and “Garden Classic.” It also described the rings as complimentary, personalized, and made by the same jeweler as the players’ rings.
Unfortunately, the offer was nothing more than a phishing simulation that Madison Square Garden reportedly conducted amid James Dolan’s concerns about cybersecurity. Employees who clicked the link were required to complete cybersecurity training, and many longtime MSG employees, including some involved in the Knicks’ business operations, were reportedly not going to receive championship rings at all.
The controversy extended to the team’s opening-night ceremony on Tuesday night, when assistant coaches were presented with ring boxes that appeared to be empty. According to The Athletic’s reporting, the coaches had been told earlier that day that their rings would arrive at a later date.
Sports Media Reacts
James Dolan and the MSG organization faced renewed criticism online after The Athletic published its report.
NBC Montana’s Josh Margolis wrote on X, “Disguising a phishing test as a championship ring order is really, really gross. The players need to get these employees some rings.”
“Only James Dolan can squander the goodwill of a NYK title this fast,” added the Cleveland Cavaliers-focused Fear the Fro’ podcast account. “Rug-pulling his employees with the false promise of a championship ring as a phishing test is tone deaf supervillain stuff.”
SB Nation writer James Dator criticized the phishing test, characterizing the fake ring offer as a scam and describing it as “beyond disgusting.”
James Dolan having a phishing email sent out to employees about rings, only to hold the ones who clicked on the link accountable and forced them to take a cybersecurity class is insanity.
Even if your worried about cybersecurity in general, to use championship rings as the way… https://t.co/Pt62NSUdTc
— The Knicks Recap (@TheKnicksRecap) October 23, 2026
Even a Knicks fan account, The Knicks Recap, criticized the move, posting, “Even if you’re worried about cybersecurity in general, to use championship rings as the lure is nasty work.”
Another Knicks fan account pushed back on the criticism, writing, “In every real corporate job in America, companies run phishing emails tests to stop employees from clicking random BS that hackers use to breach systems and potentially bankrupt the company. It’s called cybersecurity. But it’s Dolan and the Knicks, so suddenly it’s a scandal.”
So, the disagreement is not simply about whether companies should conduct phishing tests. It is about whether a test’s design and follow-up measures help employees become more secure or merely punish them for clicking.
Why Punitive Phishing Tests Can Backfire
The criticism also raises questions about how organizations should design phishing simulations. The U.K.’s National Cyber Security Centre says punishing staff for clicking a test email can start to look like “entrapment” and warns organizations to check with HR before running anything that could upset employees. According to the National Institute of Standards and Technology’s guidance on phishing exercises, “These activities should not be punitive, nor should any employee be called out for their response. When viewed as learning opportunities, the phishing exercises can provide important data on vulnerabilities and which employees may need additional learning support.”
This is not the first time a company has used a high-emotion reward as a phishing lure and then faced blowback. In December 2020, GoDaddy sent employees an email promising a $650 one-time holiday bonus. Recipients who wanted the money were told to click a link and fill out a form with personal details by a set deadline. Roughly 500 employees did so, and two days later, those who clicked received a follow-up from the company’s chief security officer informing them they had failed a phishing test and would need to retake security awareness training. GoDaddy later apologized, saying it understood “some employees were upset by the phishing attempt and felt it was insensitive.”
At the same time, the organization did choose a lure that makes sense from a technical perspective. In a recent report, Kaspersky found that a FIFA-themed phishing simulation promoting prizes for wearing a national team jersey achieved a 66% click rate. So yes, a fake ring offer was plausible enough to catch people. The problem is that the best click-through bait should be balanced with the need to keep the overall work environment positive.
MSG’s Broader History of Aggressive Security Measures
The phishing test also landed in a context where Dolan and his companies have already drawn criticism for aggressive security measures. During the Knicks’ 2026 NBA Finals run, security around Madison Square Garden was significantly tightened for Game 3 because President Donald Trump was attending. ABC7 New York described an extensive security perimeter, multiple checkpoints, TSA-style screening, a no-bag policy, and instructions for fans to arrive two hours early.
Still, there have been plenty of concerns around MSG’s security tech when Trump isn’t attending too. Madison Square Garden has operated for years with a facial-recognition system that is designed to scan every person who walks through its doors. The technology first became public in 2018. In 2023, reporting described how MSG Entertainment used facial-recognition technology to identify lawyers affiliated with firms involved in litigation against the company and deny them entry to its venues, including in cases where the individual lawyers were not personally handling the relevant disputes.
MSG’s use of facial-recognition technology has also drawn criticism over its treatment of people who have publicly criticized Dolan. In March 2025, Seattle resident Frank Miller was turned away from a show at Radio City Music Hall, another MSG Entertainment venue. Miller had previously designed a T-shirt critical of Dolan but said he had never worn it. MSG, however, stated that Miller had made threats against an MSG executive on social media and had produced and sold merchandise it considered offensive.
In July, further reporting from Wired revealed a leaked MSG database that assigned risk scores to celebrities and their guests, with well-known Knicks fans like Ben Stiller marked “low risk” and certain rappers marked “high risk.”
