Knicks staff click fake ring email, face mandatory security class

Two Madison Square Garden employees must now sit through a mandatory cybersecurity class after clicking a link in a simulated phishing email. The message, which offered free championship rings, was sent by the New York Knicks organization in late September. The New York Times reported the incident on Thursday, citing team sources.

The email carried the subject line, “Congratulations, your Employee Championship Ring is here.” It instructed recipients to click a link to select between two ring designs. Staff members who opened the link were identified as having fallen for the test and subsequently assigned to the training session.

Knicks owner James Dolan reportedly ordered the training to address his growing concerns about cybersecurity. Dolan also owns the New York Rangers and Madison Square Garden. The exercise was part of a broader effort to monitor how well employees spot suspicious communications.

Simulated phishing campaigns are standard practice in large organizations. These tests mimic internal communications but include subtle errors to catch the unwary. For instance, Condé Nast, the parent company of Ars Technica, sends test emails from a misspelled domain address. It remains unclear whether the Knicks message included similar red flags, such as an incorrect web address.

The offer was plausible for several reasons. NBA team employees typically receive championship rings, though their versions are less elaborate than those given to players. The timing also added weight to the lure, as the Knicks recently won their first NBA title in more than 50 years.

Senior NBA writer Joe Vardon noted that the fake offer tied to the team's milestone victory could easily fool or irritate staff. The Times report distinguished this incident from a separate event on Tuesday, when assistant coaches received boxes containing no rings during the first league championship banner raising since 1973.