Knicks force staff into cyber class after fake ring click

The New York Knicks required employees to attend a mandatory cybersecurity course after they clicked a link in a simulated phishing email. The email, sent in late September, offered free championship rings to staff members.

The message arrived with the subject line: "Congratulations, your Employee Championship Ring is here." Recipients were instructed to click a link to select one of two ring designs. Madison Square Garden staff who clicked the link were flagged for the training session. The exercise was designed to test how well employees could identify scams in their inboxes.

James Dolan, owner of the Knicks, the New York Rangers, and Madison Square Garden, reportedly grew concerned about cybersecurity risks. The training aimed to address those concerns. Large organizations frequently use these tests to identify workers who overlook warning signs in suspicious messages. Such emails often mimic legitimate internal communications but contain subtle errors.

The specific red flags in the Knicks email were not detailed in the report. The offer itself was plausible because most NBA team employees receive rings, though less elaborate versions than the players. Joe Vardon, a senior NBA writer for The Athletic, noted this standard practice. The Athletic merged into The New York Times in 2022.

The timing of the test added context. The Knicks won their first NBA championship in more than 50 years. A fake offer tied to that milestone carried extra weight for the staff. The organization raised its first league championship banner since 1973 on Tuesday. Assistant coaches received boxes during the ceremony that did not contain rings. They are expected to receive their rings at a later date.

The cybersecurity training for those who clicked the link was mandatory. The email originated from the team's internal communications channel. The test served as a practical assessment of staff vigilance in a high-profile organization.