Knicks employees forced into cyber class after clicking fake ring email

Two Madison Square Garden employees now face a mandatory cybersecurity course because they clicked a link in a fake email.

The New York Knicks sent the deceptive message to staff in late September. The subject line read, "Congratulations, your Employee Championship Ring is here." Recipients were instructed to click a link to select between two ring designs. According to The New York Times, which cited team sources, the two employees who engaged with the link were required to attend the training session.

James Dolan, who owns the Knicks, the New York Rangers, and Madison Square Garden, reportedly ordered the training to address his growing concerns about digital security. Dolan uses simulated phishing messages as a tool to gauge how well workers identify scams. Such tests are common in large organizations and often mimic internal communications to see if staff overlook warning signs.

The offer was plausible for the audience. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team employees typically receive championship rings, even if their versions are less elaborate than the players' jewelry. The Knicks recently won their first NBA title in more than 50 years, a milestone that likely gave the fake offer extra weight. Staff members could easily believe a free ring was part of the celebration.

It is unclear if the email contained obvious red flags, such as a misspelled domain address. Condé Nast, the parent company of Ars Technica, uses a similar tactic by sending test emails from a misspelled domain, "condenest.com." The Knicks test did not specify if it used a similar trick to catch employees off guard.

The security test arrived just before a major team event. On Tuesday, the Knicks raised their first league championship banner since 1973. During that ceremony, assistant coaches received boxes that contained no rings inside. The team indicated those coaches are expected to receive their rings at a later date.