Knicks phishing test backfires as DHS leak exposes 41,000 workers

Dark Reading reports that three notable cybersecurity-linked stories dominated this week. First, MSG Sports, owner of the New York Knicks, ran what it characterises as a phishing simulation that backfired on ring-day. The Athletic said emails offered free championship rings ahead of the banner-raising ceremony on 20 October, but employees who clicked the links were told they had failed the test and must attend mandatory cybersecurity training; no rings were issued. Dark Reading notes the stunt as an ill-timed and ill-conceived exercise, with the Knicks’ ownership later calling it “an unfortunate mistake”.

Second, a purported DHS data leak, dubbed Icepick by the transparency group DDoSecrets, exposed records for about 41,000 DHS employees and contractors across agencies including ICE, CBP, USCIS and CISA. The attackers claimed the data came from a DHS Okta-based identity system; Okta denies compromise of its systems.

DHS said it is conducting incident response for a “potential breach”, while reviewers cautioned that the data—names, work emails, phone numbers, office locations and more than 55,000 internal permissions groups—appears legitimate and could reveal investigative and surveillance programmes. The article notes the sensitivity of the exposure and the need for resolution.

Finally, The New York Times reported that NVIDIA CEO Jensen Huang was reportedly the target of a Chinese asset, named Alice Huang, who allegedly sought influence over US AI policy. The Times piece describes a “close relationship” rather than a romantic or intimate tie, and raises questions about what steps NVIDIA and authorities took to mitigate or address the disclosures. Reporters observed a lack of detailed remediation information in the piece and discussed implications for corporate and national security.