Knicks staff face mandatory cyber training after clicking fake ring email

Madison Square Garden employees who clicked on a suspicious internal email in late September are now required to complete a mandatory cybersecurity course. The New York Times reported on Thursday that the New York Knicks organization deployed the message as a test to measure staff awareness of potential scams.

The email, sent in late September, featured the subject line, “Congratulations, your Employee Championship Ring is here.” Recipients were instructed to click a link to select between two different ring designs. According to team sources, any employee who engaged with the link was subsequently enrolled in the training session.

James Dolan, owner of the Knicks, the New York Rangers, and Madison Square Garden, reportedly ordered the training to address his growing concerns regarding the organization's digital security posture. The initiative aims to identify which workers overlook warning signs in suspicious communications, a common practice among large corporations.

The scenario was particularly convincing for staff. Most NBA team employees traditionally receive championship rings, though these versions are typically less elaborate and less expensive than those awarded to players. The offer gained additional credibility because the Knicks recently secured their first NBA championship in over 50 years.

Joe Vardon, a senior NBA writer for The Athletic, noted that the timing of the phishing test coincided with a period of heightened excitement for the organization. The Athletic, which was acquired by The New York Times in 2022 and later merged into the parent company, highlighted the unique context of the fake offer.

It remains unclear if the email contained obvious red flags, such as a misspelled domain, which are standard features in simulated phishing messages used by companies like Condé Nast. Condé Nast, the parent company of Ars Technica, uses a misspelled domain, “condenest.com,” in its own internal tests to help employees spot discrepancies.

The phishing incident occurred shortly before a separate ring-related event on Tuesday. During the raising of the Knicks' first league championship banner since 1973, assistant coaches were presented with boxes that contained no rings. The team indicated that these staff members will receive their actual rings at a later date.