Knicks staff click fake ring email, triggering mandatory security training

Madison Square Garden employees who clicked a fake championship ring link are now required to attend a mandatory cybersecurity class. The New York Times reported on Thursday that the New York Knicks organization implemented this requirement for staff members who fell for a simulated phishing email sent in late September.

The email, which appeared to come from the team, carried the subject line, "Congratulations, your Employee Championship Ring is here." It instructed recipients to click a link to select between two ring designs. According to team sources cited by the Times, the training was designed to address owner James Dolan's growing concerns about cybersecurity vulnerabilities within his organizations, which include the Knicks, the New York Rangers, and Madison Square Garden.

Simulated phishing tests are a standard practice for large companies. These tests often mimic internal communications but include subtle clues, such as misspelled domain names, to gauge employee vigilance. For instance, Condé Nast, the parent company of Ars Technica, sends test messages from the address "condenest.com." It is currently unclear if the Knicks email contained similar obvious red flags.

The offer was plausible because most NBA team employees receive championship rings, though these versions are typically less elaborate than those given to players. The timing added to the deception, as the Knicks had just secured their first NBA title in more than 50 years. Joe Vardon, a senior NBA writer for The Athletic, noted that the milestone made the fake offer a credible lure for staff.

Vardon's recent reporting also covered a separate incident involving actual rings. On Tuesday, the Knicks raised their first championship banner since 1973. During that ceremony, assistant coaches received boxes that did not contain rings. The team has stated that the coaches will receive their rings at a later date.

The cybersecurity training will now be a required step for any employee who clicked the September link. The specific content of the course and the duration of the training were not detailed in the report. Dolan owns the Knicks, the Rangers, and Madison Square Garden.