VULNpocalypse
InformationalEcosystem changeMonitoring

Dark Reading reports MSG Sports phishing test misfired on Knicks staff

Dark Reading reports, citing The Athletic, that MSG Sports ran a poorly timed phishing test on Knicks staff; review how you time simulations.

Published
Exploitation
No, the sources describe an internal phishing simulation, not an attack

What happened

According to Dark Reading, which cites a report in The Athletic, Madison Square Garden (MSG) Sports, owner of the New York Knicks, sent a phishing simulation to employees ahead of the team’s banner-raising ceremony on Oct. 20. Dark Reading says the emails offered free championship rings. Employees who clicked to select a ring were told they had failed the test and must attend mandatory cybersecurity training. They did not get rings either, per the same report.

Dark Reading says an MSG spokesperson called the episode “an unfortunate mistake”. The original Athletic article is not among our sources, so the details come second-hand from Dark Reading’s video transcript. The transcript was edited by an AI assistant, according to Dark Reading. Dark Reading’s editors also say that employees traditionally receive rings and that many reportedly did not get them this year. We have not independently verified any of this.

The same Dark Reading episode covers a separate story. It says the group Distributed Denial of Secrets published a data set called Icepick, with records for roughly 41,000 DHS employees and contractors, received from a hacktivist group calling itself the Department of Peace. According to Dark Reading, the attackers claim the data came from an Okta-based DHS identity system. Okta is quoted as saying it has no evidence its data or systems were compromised. DHS reportedly said it is investigating a potential breach. Dark Reading says it is unclear how the data was obtained. That claim is not confirmed in the source.

Am I affected?

Nothing in the source describes a software flaw, a CVE or an exploited weakness in the phishing test story. It is relevant only if your organization runs phishing simulations. Whether any DHS-related data affects you is not confirmed by the source.

What to do now

  1. Review the lures in your phishing simulations. Dark Reading’s editors say tests should be appealing to click, but should not lean on employees’ desperation or on rewards they expect. This is their opinion, not a technical standard.
  2. Check the calendar for sensitive moments such as bonuses, awards or similar events before scheduling a test. This step is our editorial suggestion drawn from the episode, not a sourced requirement.
  3. For the DHS claim, wait for official confirmation. The source says the entry point and the agency’s confirmation are still open.

Sources