Knicks sent employees fake offer of championship rings in phishing test: Report

The New York Knicks organization sent employees a phishing email promising free championship rings in a test of its staff’s ability to detect scams, The New York Times reported yesterday.

据《纽约时报》昨日报道，纽约尼克斯队组织向员工发送了一封承诺提供免费冠军戒指的钓鱼邮件，旨在测试员工识别诈骗的能力。

“Congratulations, your Employee Championship Ring is here,” the email sent in late September said, instructing employees to click a link to make a selection from two ring designs.

9月下旬发送的这封邮件写道：“恭喜，您的员工冠军戒指已送达”，并指示员工点击链接，从两款戒指设计中进行选择。

Madison Square Garden employees who clicked that link “were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan’s growing cybersecurity concerns,” the report said, citing team sources.

据报道援引球队消息人士称，点击该链接的麦迪逊广场花园员工“被迫参加了一门强制性的网络安全课程，以帮助满足（老板詹姆斯·）多兰日益增长的网络安全担忧”。

Dolan is the owner of the Knicks, the New York Rangers, and Madison Square Garden. It’s common for corporations to send phishing emails to find out which employees don’t pay attention to clues that an email is a scam.

多兰是尼克斯队、纽约游骑兵队和麦迪逊广场花园的老板。企业发送钓鱼邮件以找出哪些员工不注意邮件诈骗线索的做法很常见。

A cybersecurity-test email often appears to be from the company itself but includes telltale signs of phishing. For example, Ars Technica owner Condé Nast sends phishing-test messages from email addresses with a misspelled domain, “condenest.com.”

网络安全测试邮件通常看起来像是来自公司内部，但会包含明显的钓鱼迹象。例如，Ars Technica 的所有者康泰纳仕集团（Condé Nast）发送的钓鱼测试邮件，其发件地址的域名拼写错误，为“condenest.com”。

It’s not difficult for the typical Ars Technica reporter or editor to spot this kind of tell, but we haven’t received any offer as valuable as a free NBA championship ring. We can hardly blame a Knicks organization staffer for being fooled or at least greatly annoyed by a fake offer of a ring commemorating the basketball franchise’s first NBA championship in more than half a century.

对于一般的 Ars Technica 记者或编辑来说，发现这种破绽并不难，但我们从未收到过像免费 NBA 冠军戒指这样有价值的提议。我们很难责怪尼克斯队的员工被骗，或者至少对这封虚假的戒指提议感到非常恼火，毕竟这枚戒指是为了纪念该篮球队半个多世纪以来的首个 NBA 总冠军。

We don’t know whether the Knicks email had any obvious signs that it was a phishing test, such as a misspelled domain name. The offer wasn’t implausible, either.

我们不知道尼克斯队的这封邮件是否有任何明显的钓鱼测试迹象，例如域名拼写错误。而且，这个提议本身也并非不可信。

“Typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive,” wrote Joe Vardon, senior NBA writer for The Athletic, which was bought by The New York Times in 2022 and then merged into the parent news organization.

“通常情况下，大多数 NBA 球队的员工都会收到戒指，即使它们不像球员收到的那样华丽昂贵，”《The Athletic》的资深 NBA 作家乔·瓦登（Joe Vardon）写道。《The Athletic》于 2022 年被《纽约时报》收购，随后并入该母新闻机构。

Vardon’s article was primarily about how Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. The assistant coaches were handed boxes without rings inside, though they are expected to receive rings later on.

瓦登的文章主要讲述了周二尼克斯队升起自 1973 年以来的首面联赛冠军旗帜时，助理教练们却没有收到戒指的情况。助理教练们拿到的盒子里并没有戒指，尽管预计他们稍后会收到。

“Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night… The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks’ business operations, will not receive rings at all, team sources told The Athletic,” Vardon wrote.

瓦登写道：“戒指的订购、设计和测量需要时间，并非每位卫冕冠军的教练组成员都能在颁奖之夜拿到戒指……尼克斯队的助理教练们被告知最终会收到冠军戒指，但麦迪逊广场花园的许多长期员工，包括一些在尼克斯队商业运营部门工作的员工，根本不会收到戒指，球队消息人士告诉《The Athletic》。”

MSG employee hopes were raised “at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings,” Vardon wrote. The email included “a graphic of two differently styled rings” that the lucky employees could supposedly choose from, the article said.

瓦登写道，麦迪逊广场花园员工的希望在“9月底被点燃，当时尼克斯队向一大批员工发送了一封电子邮件，让收件人首次看到了他们可能获得的冠军戒指”。文章称，邮件中包含了“两款不同风格戒指的图片”，幸运的员工据称可以从中进行选择。

“(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you,” the email said. “There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below.”

邮件中写道：“（员工姓名），这是免费赠送的。麦迪逊广场花园正在发放员工冠军戒指。同样的珠宝商，同样的工艺，刻有您的名字。无需您支付任何费用。有两种设计可供选择：冠军金（Championship Gold）和花园经典（Garden Classic）。请在下方预订您想要的那一款。”

Vardon wrote that “multiple team sources” confirmed the email was a phishing test. It’s not clear how many employees clicked the link, and it wasn’t immediately clear how many employees will eventually get some type of championship ring.

瓦登写道，“多位球队消息人士”证实该邮件是一次钓鱼测试。目前尚不清楚有多少员工点击了该链接，也不清楚最终会有多少员工能获得某种类型的冠军戒指。

We contacted the Madison Square Garden Sports organization with these questions and received a statement after this article was published. The statement called the phishing test “an unfortunate mistake,” and detailed plans to give rings to staff.

我们就这些问题联系了麦迪逊广场花园体育组织，并在本文发表后收到了一份声明。声明称此次钓鱼测试是“一个不幸的错误”，并详细说明了向员工发放戒指的计划。

MSG’s statement said the company “sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers. MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees’ attention was an unfortunate mistake.”

麦迪逊广场花园的声明称，公司“向其企业团队发送了一封电子邮件，作为旨在加强我们防范黑客安全能力的钓鱼攻击模拟。麦迪逊广场花园最近遭到黑客攻击和勒索，黑客使用了通过类似钓鱼攻击获得的员工登录名和密码。利用戒指作为诱饵来吸引员工的注意力是一个不幸的错误。”

As for the ring-distribution plan, MSG said it “is gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.”

关于戒指发放计划，麦迪逊广场花园表示，它“正在向球员、教练、员工以及尼克斯大家庭的其他成员赠送超过 275 枚冠军戒指和珠宝，价值超过 370 万美元，以表彰他们的贡献并庆祝这一成就。”

This article was updated with MSG’s statement.

本文已根据麦迪逊广场花园的声明进行了更新。