The Championship Ring Was the Bait.

Why Dolan’s cybersecurity concerns were real

James Dolan has run Madison Square Garden’s sports properties since 1999, and for most of that stretch he was the owner Knicks fans blamed. On June 13, 2026, the Knicks beat the Spurs 94–90 in Game 5 and won their first title since 1973. Dolan’s message to the city was an apology: “I’m sorry it took so long. But here we are.”

Three days later, his company’s data was on the internet. The intrusion had started on June 5, three days into the Finals, with a phone call to one employee. What came out was 9.8 million customers’ email addresses, the home addresses of former players and celebrities, and the logs of the facial-recognition entry system Dolan personally went on television to defend in 2023 as a security tool. Sitting next to those logs was a document profiling three of that system’s public critics. The first class action, filed the next day, went straight at the program.

And it was the second time. Ten months earlier, files of names and Social Security numbers from MSG’s hiring and payment records had walked out through a vendor’s Oracle server. Those are records about the people MSG employs and pays. By the summer of the championship, every layer the owner could point to had failed in public: a vendor’s server, the company’s own identity platform, and the surveillance system he had staked his name on. That is where “growing cybersecurity concerns” comes from.

Were those concerns well founded? The industry numbers say yes, on both counts. CrowdStrike’s 2026 Threat Hunting Report found that vishing intrusions doubled in the first half of 2026, the same half MSG was hit, with eCrime crews using phone calls to take over single sign-on accounts and, in one case, moving from account takeover to data theft in under five minutes. Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches now start with a software vulnerability, overtaking stolen passwords as the most common way in. That is the shape of the August 2025 breach. Dolan was not being paranoid. He was looking at the two most common doors of the year, and both had already opened on him.

Why now? Phishing is older than most of the people it targets. What changed is where the access lives and who holds the key to it. Four shifts explain why a phone call to one employee is worth more to an attacker in 2026 than it was five years ago.

One login now opens everything. Companies consolidated their applications behind single sign-on, which is good for productivity and good for attackers. CrowdStrike describes intrusions that “now move through trusted identities, SaaS applications, and cloud infrastructure,” and its 2026 hunting data shows crews compromising SSO-connected SaaS apps specifically to exfiltrate data. MSG’s June attacker didn’t need to break anything. One set of credentials opened Microsoft Entra, and Entra opened the rest.

MFA moved the target from the password to the person. A stolen password alone is worth less than it used to be, because most logins now ask for a second factor. So the attacker stays on the phone while the victim completes it. Mandiant describes kits that sync the caller’s script with live MFA prompts, then “enroll threat actor controlled devices into victim multifactor authentication solutions.” Monthly device-code phishing attempts, another way to get a person to approve a login for someone else, rose 15× in the first half of 2026.

Email got filtered. Phones didn’t. A decade of investment went into scanning inboxes. Nothing scans a phone call. As Halcyon’s Cynthia Kaiser told CyberScoop, voice reaches people where they “don’t necessarily have their guard up.” An employee who has been trained for years to hover over links has rarely been trained to hang up on someone who sounds like the help desk.

The clock collapsed. In one 2026 incident CrowdStrike tracked, a crew went from account takeover to data theft in under five minutes. When the gap between one bad phone call and a public leak is that short, wanting to know how your employees handle the phone is the obvious move.

The record, in six dated events. Two different attackers, two different doors, and one of them opened by a person on the phone.

What got in, and what the ring email measured

Read against the record, the ring test aimed at the right population and the right moment. It measured a different behavior than the one that failed in June, and it had no reach at all into the one that failed in August.

From simulation to fire drill

A phishing simulation asks who clicked. A phishing fire drill asks how fast the organization responded. Many security teams have moved from the first to the second, and the difference would have changed almost everything about this story.

A simulation is unannounced, scored on click rate, and usually comes with a consequence for failing. The ring email is a textbook example. It told employees that the organization was finally including them in something that happens once every fifty-three years, then sent the ones who believed it to a mandatory class. That is a gotcha with a KPI attached.

A fire drill works the way a building evacuation does. Everyone knows drills happen. Nobody is disciplined for walking out the wrong door. The point is to rehearse the response until it is automatic, and the scores are the ones that matter during a real incident: how many people reported, how fast, and how long it took the security team to contain it.

A drill would have rehearsed the June failure. Run on the pattern that actually hit MSG, it looks like this. Someone calls during a big event claiming to be IT. The employee hangs up, calls the help desk back on a number they already know, and reports the call. The help desk refuses to re-enroll MFA on a phone request. The security team revokes sessions in the identity platform. The score is minutes from first ring to containment, which is the only number that counts against a crew that can move from account takeover to data theft in under five minutes.

The ring could still have been the lure. “This quarter’s drill uses an event-themed pretext” turns the championship into a lesson instead of a betrayal. Employees who don’t feel tricked don’t take the story to The Athletic.

It builds the trust the simulation spent. The people who clicked the ring email will tell their coworkers what it was. The next time anybody at MSG sees a legitimate note about a payroll correction or an open-enrollment deadline, the first instinct will be to assume it is another trick, and the next strange phone call is less likely to get reported to the people who could stop it. A drill rewards the report, which is the one behavior MSG most needs more of.

The tradeoff: announced drills flatter the results, because people perform better when they know a test is coming. Mature programs run mostly drills and a smaller number of unannounced tests, under the same no-discipline rule.

The policy and standards layer

A security awareness program is a process control. Process controls have policies, standards, named owners, and evidence that they ran. That layer is what turns an owner’s concern into a program instead of a single email.

What vCISO Lite would and wouldn’t have changed

The temptation is to claim a platform would have stopped both breaches. It wouldn’t. Here’s the split.

Our read

Three positions, in order of confidence.

One. Half of MSG’s record had nothing to do with employees, and that half is the one no awareness program can reach. The August 2025 breach ran through a vendor-hosted system and a zero-day, which is now the most common way into an organization according to Verizon’s 2026 DBIR. The fix for that lives in third-party patch cadence, vendor incident response, and knowing which vendors host what. None of it is visible to employees, which is exactly why it tends to lose the budget conversation to something that is.

Two. The ring was realistic bait, and the outrage misses that. The June intrusion ran underneath the Finals, while the whole company was watching basketball. The next one will pick a moment like that too. An event-timed lure aimed at employees is a fair reading of the threat MSG actually faced. Calling it a prank lets everyone skip the harder conversation.

Three. What failed was the follow-through, not the instinct. The June failure was a voice call and a surrendered credential, and the test measured an email click. Then it answered the click with a mandatory class, which teaches people to stay quiet the next time something feels off. Dolan’s concern was the right one. It needed a program to run through: a clause, a standard, an owner, and a cycle that tests the behavior that actually broke.