Knicks staff must take cyber class after clicking fake ring email

Major sports organizations routinely test their staff with simulated phishing emails to identify security gaps. The New York Knicks recently deployed one of these tests, using a familiar sports prize as the bait.

A New York Times report published on Thursday details how the Knicks sent an internal email in late September. The subject line read, "Congratulations, your Employee Championship Ring is here." The message instructed recipients to click a link to select between two ring designs.

Team sources cited in the report stated that Madison Square Garden employees who clicked the link were required to attend a mandatory cybersecurity class. Owner James Dolan ordered the training to address his concerns about the organization's digital security. Dolan also owns the New York Rangers and Madison Square Garden.

Simulated phishing is a standard practice in large corporations. These tests often mimic legitimate internal communications but include subtle flaws, such as misspelled domains. Condé Nast, the parent company of Ars Technica, uses a similar method by sending test emails from an address using the domain "condenest.com."

It remains unclear if the Knicks email contained obvious red flags like a misspelled address. The offer was also plausible for employees. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team staff receive championship rings, though they are usually less elaborate than the players' versions.

The timing of the test added weight to the lure. The Knicks recently won their first NBA championship in more than 50 years. Vardon pointed out that staff might have been more likely to accept the offer or feel annoyed by the fake notification given the recent milestone.

Vardon's article also covered a separate ring-related incident that occurred on Tuesday. The Knicks raised their first championship banner since 1973 during that event. Assistant coaches received boxes containing no rings, with the team stating they will receive their actual rings at a later date.