Knicks owner mandates cyber training after staff clicked fake ring email

James Dolan, owner of the New York Knicks, ordered mandatory cybersecurity training for Madison Square Garden employees who clicked a fake email link in late September. The message, sent as a phishing test, offered staff free championship rings and instructed them to select a design by clicking a provided link. According to The New York Times, which cited team sources, those who took the bait were required to attend a security class. Dolan also owns the New York Rangers and Madison Square Garden. The training was intended to address growing concerns about digital security within the organization.

The subject line of the email read, "Congratulations, your Employee Championship Ring is here." The offer was not an unlikely one for sports industry workers. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team employees typically receive rings, even if they are less elaborate than the versions given to players. The Athletic was acquired by The New York Times in 2022 and later merged into the parent news organization. Vardon observed that staff members might have been forgiven for being fooled, or at least irritated, by a fake offer tied to the team's recent success.

Simulated phishing messages are a standard practice at large companies. Organizations use these tests to identify which workers overlook warning signs in suspicious emails. These messages often appear to come from the employer but contain subtle clues that give them away. Condé Nast, the parent company of Ars Technica, sends similar test messages from an address with a misspelled domain, specifically "condenest.com." It remains unclear whether the Knicks email contained obvious red flags of that kind, such as a misspelled domain.

The timing of the test added weight to the lure. The Knicks recently won their first NBA championship in more than 50 years. This milestone made the offer of a championship ring feel plausible to many employees. The team raised its first league championship banner since 1973 on Tuesday. During that ceremony, assistant coaches were handed boxes that contained no rings inside. They are expected to receive their physical rings at a later date.

The phishing test occurred in the context of a recent organizational shift. The New York Times reported on Thursday that the email campaign was a deliberate attempt to gauge employee vigilance. The mandatory class serves as a corrective measure for those who did not spot the simulation. Dolan's ownership of multiple major sports properties and a shared arena increases the complexity of the organization's digital infrastructure. The training aims to reduce the risk of real breaches by reinforcing basic security habits among staff members who work across different entities.