The Knicks Have Gone Phishing

As cybersecurity awareness month came to an end, the NY Knicks found themselves in a public relations pickle all from what they did to test their employees to see if they fall for a scam.

Let's start with what phishing is. Phishing is a type of cyberattack where criminals trick people into sharing sensitive information—like passwords, credit card numbers, or login credentials—or installing malware by pretending to be a trusted source. There are a variety of ways in which they try to do this via email, but it tends to play on emotions and/or a sense of emergency. The front office of the NY Knicks and Madison Square Garden, both run by noted paranoid-about-cybersecurity CEO, James Dolan, decided to test out a phishing attack on the office staff.

They sent out an email to employees saying they were being gifted a ring to celebrate the Knicks' recent NBA championship to go along with the team's rings. There was a link to click. The ones who clicked it were made to do cybersecurity training.

Some people felt this was cruel and a poor decision to pick something so emotional. I feel this was a was a great idea to capitalize on the moment of the championship. I happen to know that the phishing tests that have "attached is this year's bonus payout schedule" result in the most successful failures due to how many people click. If I were a criminal, I would have sent out emails like that if I were smart enough to think of it. From personal experience, think of all the spam/phishing emails you get that are scattershot and done with hope and a prayer based on odds. Example: the amount of popular accounts I get emailed about saying there was an attempt to re-set my password and to respond immediately by clicking here. Well...I have none of those popular accounts so I know they are phishing scams. What the in-house cyber team at MSG did was something so timely and targeted...and the last championship for any sports team in MSG was the NY Rangers winning the Stanley Cup in 1994...no one would be the wiser to say "That's not what they usually do!"

Was what MSG did really that bad or slightly genius? I bet more of their employees will be less likely to jump to click anything now.

The Knicks did wind up promising them all a free ring after the news broke. After. The rings will come in around $2M for the office staff. That's still a lot cheaper than a cyberattack on MSG.

Thinking of ways to keep your team on their toes...