A fan's dream of a championship ring turned out to be bait, and the sting landed on the people who work quietly behind the scenes of a great team. Madison Square Garden, having been breached itself through a single stolen password, reached for the most tempting object it could think of to teach its staff a lesson about the ordinary doors attackers walk through. The lure was clumsy, and the organization has admitted as much, yet its aim was to protect the people who make the building run. Now the rings are coming to everyone, and the story leaves behind a reminder that the sweetest offers in an
MSG Admits Using Knicks Championship Rings as Bait in Phishing Test, Calls It 'Unfortunate Mistake'
There was no jewelry behind the link.
Mark
So the email that looked like a gift was actually a security drill?
Mimi
Yes. MSG confirmed it Friday. Staff were offered a free personalized ring, and anyone who clicked the link got a mandatory cybersecurity class instead.
Mark
Why would MSG run a test like this at all?
Mimi
By its own account, it was recently hacked and extorted, using an employee login and password taken through a similar phishing attack.
Luke
That explanation is MSG's own statement. We don't have details of the breach, like when it happened, what was demanded, or what was exposed.
Mark
And the timing? The test went out last month, but the story broke this week.
Mimi
The reports said employees were told not to expect rings, so the email landed on people who had reason to want one. MSG called using the rings as a lure an unfortunate mistake.
Luke
Worth noting the class is attributed to The Athletic, and the link to Dolan's concerns is that outlet's framing. MSG's statement confirms the test, not the details of the class or how many people clicked.
Mark
What changes now?
Mimi
MSG says it will give more than 275 rings and pieces of jewelry, worth over $3.7 million, to players, coaches and staff.
Luke
Still unknown is the timeline, and whether employees' pieces match the players' $100,000 rings. The statement doesn't say.
Il Polso
- A simulated phishing email dangled free championship rings in front of Knicks staff, and those who clicked were sent to mandatory cybersecurity training instead of jewelry.
- The test landed hard because assistant coaches and employees had been left without rings while players were celebrated at the season opener.
- MSG is trying to repair the damage by admitting the rings were an unfortunate mistake, after a real hack and extortion began with a stolen employee login.
- The organization has pledged more than 275 rings and pieces of jewelry worth over $3.7 million, but when staff will receive them remains unannounced.
A fan's dream of a championship ring turned out to be bait, and the sting landed on the people who work quietly behind the scenes of a great team. Madison Square Garden, having been breached itself through a single stolen password, reached for the most tempting object it could think of to teach its staff a lesson about the ordinary doors attackers walk through. The lure was clumsy, and the organization has admitted as much, yet its aim was to protect the people who make the building run. Now the rings are coming to everyone, and the story leaves behind a reminder that the sweetest offers in an inbox deserve the most suspicion.
On Tuesday night, the Knicks raised their first championship banner since 1973. The players received 22-carat rings, each worth at least $100,000 and set with roughly 800 diamonds, to mark the summer series win over the San Antonio Spurs.
The mood soured late Thursday, when word spread that the organization had not given rings to its assistant coaches or other employees. Coaches were told theirs would come later, and staff were told not to expect any at all.
Seen in that light, an email from last month read differently. Employees had received a message offering a complimentary championship ring, personalized with their name, made by the same jeweler, and available in two designs through a link. There was no jewelry behind the link. Those who clicked were required to attend a mandatory cybersecurity class.
On Friday the team confirmed the email was a phishing test, run after MSG was hacked and extorted through an employee's login obtained by a similar phishing attack. The company admitted that using rings as bait was an unfortunate mistake, and announced that more than 275 rings and pieces of jewelry, worth over $3.7 million, will go to players, coaches, employees and others in the Knicks family. The timing of that distribution, and how those rings will differ from the players', has not been revealed.
On Tuesday night, in the Knicks' season opener, the team raised its first championship banner since 1973. The players received 22-carat rings estimated to be worth at least $100,000 each, with roughly 800 diamonds apiece and a recreation of the world's most famous arena. The Knicks had beaten the San Antonio Spurs in five games over the summer to earn them.
The trouble started late Thursday, when it was reported that the organization had not given rings to its assistant coaches or other employees. Coaches were reportedly told they would eventually get theirs, though not alongside the players on Tuesday. Employees, apparently, were told not to expect any.
That made an email from last month look different in hindsight. According to reports, staff received a message that read, in part: "(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring." It promised the same jeweler and the same craftsmanship, personalized with the recipient's name, at no cost. There were two designs to choose from, Championship Gold and Garden Classic, and employees were invited to reserve one through a link below.
There was no jewelry behind the link. The Athletic reported that those who clicked did not get to choose a ring. Instead they were required to attend a mandatory cybersecurity class, which the outlet tied to owner James Dolan's growing concerns about security.
The team confirmed on Friday that the email was a test. In a statement, MSG said the company had earlier sent its corporate team a simulated phishing attack meant to strengthen its defenses against hackers. It also gave the reason: MSG was recently hacked and extorted, using an employee's login and password obtained through a similar phishing attack.
The company acknowledged the choice of bait. Using the rings to get employees' attention, it said, was an unfortunate mistake. It then announced it would give out more than 275 championship rings and pieces of jewelry, worth more than $3.7 million, to players, coaches, employees and other members of the Knicks family, in recognition of their contributions and in celebration of the title.
The statement does not say when the remaining rings will be handed out, or how they will differ from the players' rings. What it does establish is that the staff who were passed over are now due to receive something, and that the test which reportedly stung them grew out of a real breach.
Citazioni salienti
Using the rings as a lure to gain employees' attention was an unfortunate mistake.— MSG statement
The company had previously sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers.— MSG statement
Vuoi la storia completa?
Leggi l'originale su Fox News ↗
Business