Phishing Drill: Knicks Staff Click Fake Ring Email

A simulated phishing email sent to Madison Square Garden employees in late September prompted a mandatory training requirement for anyone who clicked the link.

The message, which arrived with the subject line 'Congratulations, your Employee Championship Ring is here,' instructed recipients to select one of two ring designs by clicking a provided link. The New York Times reported on Thursday that the exercise was designed to test staff members' ability to identify suspicious communications. Team sources cited in the report indicated that the initiative aligns with owner James Dolan's expanding focus on cybersecurity across his organizations, which include the Knicks, the New York Rangers, and the arena.

Simulated phishing campaigns are standard practice in large organizations. These tests often mimic internal communications to see if employees overlook subtle warning signs. For instance, Condé Nast, the parent company of Ars Technica, has used test messages from a misspelled domain address. It is not yet clear if the Knicks email contained similar obvious errors, such as a typos in the sender domain. The offer itself may have seemed plausible to staff. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team employees typically receive rings, although staff versions are generally less elaborate and costly than those given to players.

The timing of the test added a layer of realism. The Knicks recently secured their first NBA championship in more than 50 years. Employees might have found it difficult to question an email tied to such a major milestone. Vardon's reporting also touched on a separate ring-related event that occurred this week. On Tuesday, the team raised its first league championship banner since 1973. During the ceremony, assistant coaches received boxes that did not contain rings. Those individuals are expected to receive their rings at a future date.