MSG Offered Its Employees a Championship Ring. Clicking to Pick One Sent Them to a Mandatory Cybersecurity Class.

SATURDAY, OCTOBER 24, 2026

Let’s rewind the tape, because this one was not a hacker. Nobody breached Madison Square Garden from the outside in September. The Garden did it to itself, on purpose, with the most valuable bait its own building contained: a championship ring, 53 years in the waiting, offered to the people who work there — personalised, in two designs, free. The offer was a test. Click it and you did not get a ring. You got a mandatory cybersecurity class. And when the story finally surfaced this week, the company that runs the New York Knicks needed two statements in two days to explain it — the first calling its own lure an “unfortunate mistake,” the second blaming “a great deal of misinformation” while apologising all over again. Roll it from the top, because the order is the whole story.

The email was perfect. That was the problem

Start with the bait itself, because the craftsmanship of the fake is what makes this a Rewind and not an IT memo. In September, MSG employees received an email headed, in the Associated Press’s account of The Athletic’s reporting, “Congratulations, your Employee Championship Ring is here.” It showed a graphic with two ring styles that could be selected. The full lure text, carried by theScore via The Athletic’s Joe Vardon, is worth reading slowly, because somebody wrote this the way you write a gift, not a warning: “(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you. There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below.” Same jeweler. Same craftsmanship. Your name on it. For a workforce that had just lived through the franchise’s first championship since 1973 — a five-game Finals win over the San Antonio Spurs that ended a 53-year drought — that email was not a suspicious message an employee should have side-eyed. It was the building finally saying thank you, in the exact language a thank-you would use.

And then the link at the bottom did what it was built to do. Employees who clicked it, the AP reports, were forced to attend a mandatory cybersecurity class. Read that sentence again with the temperature of the room in mind. You have worked at the Garden through some or all of a half-century wait. The team finally wins. An email arrives offering you the symbol of it, with your name engraved, no cost to you. You pick your design. And the organisation’s answer is a classroom — a failed test you did not know you were taking, on the one subject guaranteed to make you feel it. Phishing simulations are a normal corporate tool, and this desk is not pretending otherwise. But a simulation is a choice of bait, and the bait is a confession of what the sender thinks will move you. MSG reached past every ordinary lure — a password reset, a shipping notice, a bonus form — and picked the championship. The one prize in the building with real emotional weight. That is the act this segment exists to rewind, and it belongs entirely to the institution that designed it — never to the employees who clicked. They were the targets of the test, not the authors of it.

The reason was real. The bait still was not

Fairness first, in full, because MSG’s explanation deserves to be stated the way the company stated it — and because it explains a test without excusing this lure. In its Friday statement, reported by the AP, MSG said: “The company had previously sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers. MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees attention was an unfortunate mistake.” TheScore’s account adds that the test reflected concerns about exactly that kind of attack reaching an employee’s username and password. So the fear underneath the exercise was not invented. A real breach, a real extortion, a real login in the wrong hands — any security team in America would call that a reason to train people, and they would be right.

But notice what the company’s own sentence convicts and what it acquits. The simulation: defended. The security purpose: defended. The one thing MSG itself calls a mistake — in its own words, an unfortunate one — is using the rings as the lure. That distinction is the whole ballgame, and the desk did not invent it; MSG drew it. A company can teach its people to spot a fake without making the fake a championship ring. It can run the drill in any given week without timing the lesson to the first title in 53 years, when the ring was the single most believable and most desired object in the building. The hack explains why a test existed. It does not explain why the test wore a ring. And the employees on the receiving end were not careless strangers opening an attachment from a prince — they were staff being offered, by their own employer, the keepsake of the season they had just helped stage. Trusting your own building is not a security flaw. It is what a workplace runs on.

Ring night had its own empty boxes

The fake offer might have stayed an internal embarrassment if the real distribution had been spotless. It was not, and the second wound is what turned a September email into an October firestorm. On Tuesday night, Oct. 20, the Knicks received the rings they had earned before their season-opening game against Philadelphia at the Garden — the players presented individually, the banner raised, the full ceremony. The desk has already taken you inside the jewellery itself — nearly 800 diamonds and a tiny Garden that opens — and it was, by every account, a night 53 years in the making. But The Athletic reported on Thursday that assistant coaches did not get rings that night. USA Today’s first account put it plainly: the assistant coaches were handed empty boxes, creating the illusion that they had received their rings. Its Saturday account filled in the mechanics — the coaches’ rings were not ready for distribution and had not been fitted for them — and its Friday account noted the coaches had been told they would receive theirs at an unspecified later date.

Layer the reported employee picture on top of that, attributed exactly as it was reported. According to The Athletic, many longtime Madison Square Garden employees were informed they would not be receiving rings at all — the same workforce that had been emailed a choice of two designs in September. TheScore, via Vardon’s reporting, put it the same way: many longtime MSG employees, and even some Knicks business operations employees, are not going to receive Knicks rings, according to his sources. Hold that reported picture next to the fake offer for one second and the anger writes itself, without this desk adding a drop. Click the email in September: class. Read the reporting in October: maybe no ring anyway. Watch ring night: empty boxes for the men on the bench. None of those three beats is a rumour this segment manufactured — each is in the named reporting, and together they are why a cybersecurity exercise became a story about how a champion treats its own people. Even this building’s ring night produced a complaint this desk rewound — LeBron James won his 76ers debut that night and still left talking about a ‘championship whistle’ — but that was an opponent’s gripe. This one came from inside the house.

Friday: an unfortunate mistake. Saturday: misinformation

Which brings the tape to the two statements, because an institution tells you who it is by how it corrects itself. Statement one landed Friday, Oct. 23, and on its own it was close to a model corporate apology: the purpose explained, the hack disclosed, the verdict on the lure delivered by the company against itself — “an unfortunate mistake” — and the remedy quantified. “The company is gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.” Two hundred and seventy-five-plus rings. More than $3.7 million of jewellery. If the story had ended there, this segment would be shorter and kinder: a bad idea, owned quickly, with a real number attached to the fix.

It did not end there. On Saturday, Oct. 24, after what USA Today described as social media backlash over the stunt, MSG issued a second statement, obtained by USA TODAY Sports, and the tone had changed buildings. “There is a great deal of misinformation regarding the championship rings. The plan has always been to distribute more than 275 rings and jewelry to the people in the organization who were part of last season’s success. As is common with many teams, the players were always supposed to get their rings as part of the opening night ceremony and then everyone else will receive theirs in about 4-6 weeks. Regarding the phishing email, the process of securing and reminding our employees to protect our IP was not a mistake, but the choice to use the ring to do so was a mistake and we apologize to our employees and the fans.” And then the closer: “Winning the championship was a great moment for all New Yorkers. Those who choose to focus on the negative are missing the joy that comes with the team’s accomplishment.”

Read the two statements back to back and watch the apology change shape. Friday’s version: we made an unfortunate mistake, here is the remedy, here is what it costs. Saturday’s version: there is a great deal of misinformation, the plan was always the plan, the process was not a mistake, the choice was a mistake, we apologise — and by the way, if you are still talking about it, you are missing the joy. The factual core barely moved: 275-plus rings, players first, everyone else in four to six weeks, the ring-as-lure conceded as wrong both times. What moved was the posture — from owning the wound to grading the audience for noticing it. The employees who clicked a fake ring offer, sat through a mandatory class, and then read reported accounts that some of them were not getting rings at all did not create the misinformation problem, if there is one. They lived the sequence in the order it happened: lure in September, empty boxes in October, explanation on Friday, lecture about joy on Saturday. An organisation is of course entitled to correct the record. It is also, apparently, incapable of correcting the record without first correcting its own people’s feelings about it.

What the next four to six weeks have to prove

Here is where this desk lands, and it lands on the institution, at full height, the way the Rewind always punches — up. The Knicks’ title is real, the banner is real, and nobody in this segment is asking the Garden to apologise for winning. The 275-plus rings are promised on the record, twice, with a price tag and now a window: about four to six weeks from opening night for everyone beyond the players. That is a check the company has written in public, and the coming weeks will cash it or they won’t — the assistant coaches fitted at last, the employees who were part of last season’s success holding the thing the September email pretended to offer them. If that distribution lands the way Saturday’s statement describes, the story ends as an ugly chapter inside a golden season. If it slips, the tape in this segment is the receipt.

But the lesson of the lure does not expire with the delivery schedule, and it is bigger than one arena’s IT department. A championship ring is not a gift card. For the people who sell the tickets, run the building, staff the bench and answer the phones across a 53-year wait, it is the physical proof that they were part of the thing when it finally happened. Using that proof as bait — engraving a fake version of it with an employee’s own name, in two designs, at no cost — treated the most loyal audience the franchise has as a vulnerability to be probed. MSG’s own Friday verdict had it right the first time: an unfortunate mistake. Saturday’s attempt to share the blame with “misinformation” and with everyone “focusing on the negative” is the second act, and it is the act that earns the rewind. The joy was never the employees’ problem. They were ready to feel it in September. They clicked for it. More tape lives in The Rewind collection, and the rest of the league lives on the NBA hub.

THE VERDICT — After review: Madison Square Garden is outta pocket.