Knicks staff face mandatory cyber class after clicking fake ring email

Two Madison Square Garden employees who clicked a link in a fake email offering free championship rings were forced to attend a mandatory cybersecurity class. The test was sent by the New York Knicks organization in late September, according to a report by The New York Times published Thursday.

The simulated phishing message had a subject line that read, "Congratulations, your Employee Championship Ring is here." Recipients were instructed to click a link to select between two ring designs. Team sources told the Times that the exercise was designed to address owner James Dolan's increasing concerns about digital security. Dolan also owns the New York Rangers and the arena itself.

Companies in large organizations frequently use simulated phishing campaigns to identify which workers might overlook warning signs in suspicious messages. These tests often mimic internal communications but include subtle errors. Condé Nast, the parent company of Ars Technica, for example, sends test emails from a domain with a misspelling, "condenest.com." It remains unclear if the Knicks version included similar obvious red flags, such as a typos in the sender address.

The offer was not entirely outlandish for the target audience. Joe Vardon, a senior NBA writer for The Athletic, noted that most employees of NBA teams typically receive rings. While staff rings are usually simpler and cheaper than the players' versions, the expectation of a gift is standard. The Athletic was acquired by The New York Times in 2022 and subsequently merged into that parent news organization.

The timing of the test added a layer of complexity for the staff. The Knicks recently secured their first NBA championship in more than 50 years. Employees who missed the window for their actual rings or were still processing the historic win might have found the fake offer irritating or easy to believe.

Vardon’s broader reporting focused on a separate ring-related incident that occurred on Tuesday. The team raised its first league championship banner since 1973 during that event. Assistant coaches were handed boxes at the ceremony, but the containers were empty. The staff are expected to receive their actual rings at a later date.

The mandatory training for the two employees who clicked the link was reportedly intended to close gaps in the organization's defensive protocols. No other specific details about the class content or the number of total employees targeted in the late September campaign were provided in the report.