A Well-Intentioned Phishing Test Goes Awry for the New York Knicks
In a move that raises questions about timing and empathy, Madison Square Garden (MSG) Sports, which owns the NBA champion New York Knicks, recently deployed a poorly timed phishing simulation. The test was designed to educate employees on the dangers of phishing attacks, but it ended up causing confusion and frustration among team staff.
According to reports, MSG Sports sent out emails to employees with offers of free championship rings commemorating the team’s historic NBA Finals victory in June. However, when employees clicked on the links to select their rings, they were informed that they had failed the test and would have to attend mandatory cybersecurity training. And, to add insult to injury, they didn’t even get the rings.
This ill-conceived phishing simulation has sparked criticism from security experts and observers alike. While phishing tests can be an important part of cybersecurity awareness training, this particular test seems to have been poorly designed and executed. By preying on employees’ expectations of receiving a reward for their hard work, MSG Sports may have inadvertently created a situation where employees feel deceived rather than educated.
It’s worth noting that the Knicks’ owner, James Dolan, has faced criticism in the past for his treatment of team staff. The fact that many employees didn’t receive championship rings this year only adds to the controversy surrounding this phishing test. As one security expert pointed out, “phishing tests should be appealing to click on, not something that leans on the desperation of your employees.”
The incident has also raised questions about MSG Sports’ approach to cybersecurity awareness training. While it’s clear that the company wants to educate its employees on the dangers of phishing attacks, this poorly timed test may have had the opposite effect. Instead of creating a culture of vigilance and security awareness, MSG Sports may have inadvertently created a sense of distrust among its staff.
In an era where cyber threats are becoming increasingly sophisticated, it’s more important than ever for organizations to get cybersecurity right. The New York Knicks’ mishap serves as a reminder that even the best-laid plans can go awry if not executed with care and consideration. As we head into Cybersecurity Awareness Month, this incident is a stark reminder of the importance of empathy and understanding in our approach to security.
So what can organizations learn from this incident? For one, it’s essential to carefully consider the timing and tone of cybersecurity awareness training initiatives. Phishing tests should be designed to educate and inform employees, not deceive or frustrate them. By taking a more nuanced and empathetic approach to security awareness training, organizations can create a culture of vigilance and security awareness that benefits everyone involved.
Source: Dark Reading — 2026-11-05