Knicks staff click 2 fake ring links to trigger mandatory cyber training

Employees of the New York Knicks and Madison Square Garden are now required to complete a mandatory cybersecurity course after clicking a link in a simulated phishing email. The training follows a security test designed to measure how well staff can identify suspicious communications.

The test email was distributed in late September. The message featured a subject line that read, "Congratulations, your Employee Championship Ring is here." Recipients were instructed to click a link to select between two ring designs. Team sources told The New York Times that anyone who engaged with the link faced the requirement for additional security education.

James Dolan, the owner of the Knicks, the New York Rangers, and Madison Square Garden, reportedly pushed for the training due to growing concerns about organizational cybersecurity. The move places the burden of security compliance directly on staff members who failed to recognize the simulated threat during the initial test.

The scenario used in the test mirrored a common tactic in corporate security audits, where companies send fake offers to gauge employee vigilance. While such messages often contain subtle errors, such as misspelled domains, it is unclear if the Knicks email included similar red flags. The offer itself was plausible, as NBA team employees typically receive championship rings, albeit simpler versions than the players.

The timing of the test added a layer of complexity for staff. The Knicks had recently secured their first NBA championship in more than 50 years, a milestone that made a free ring offer feel less like a scam and more like a standard perk. Joe Vardon, a senior NBA writer for The Athletic, noted that the offer was not far-fetched for employees in the organization.

The phishing incident occurred just days before a separate ring-related controversy. On Tuesday, the team raised its first league championship banner since 1973. During the ceremony, assistant coaches were handed boxes that appeared to contain rings but were empty. The coaches are expected to receive their actual rings at a later date, a development that further complicated the staff's perception of recent ring-related communications.

Dolan’s decision to mandate the class signals a stricter approach to digital security within the Madison Square Garden ecosystem. By enforcing training for those who clicked the link, the organization aims to reduce the likelihood of future breaches caused by human error in its administrative ranks.