Knicks staff click fake ring link and must take security class

Two employees of the New York Knicks organization clicked a link in a fake email offering free championship rings. The click triggered a requirement that they attend a mandatory cybersecurity class.

The test email went out in late September. The subject line read, "Congratulations, your Employee Championship Ring is here." Recipients were told to click a link to choose between two ring designs. According to The New York Times, the message was a simulated phishing exercise intended to measure staff alertness.

James Dolan, who owns the Knicks, the New York Rangers, and Madison Square Garden, reportedly ordered the training. The New York Times cited team sources saying the class addresses Dolan's growing concerns about digital security at his properties.

Such tests are standard practice in large corporations. Companies send fake internal messages to see which workers overlook warning signs. Condé Nast, the parent company of Ars Technica, uses a similar tactic by sending test emails from a misspelled domain. It is not clear if the Knicks email contained obvious clues like a typos in the sender address.

The bait was realistic for several reasons. Most NBA team employees receive rings, even if the versions are simpler than those given to players. The Knicks had just secured their first NBA championship in more than 50 years. The recent success made the offer of a commemorative item feel plausible to staff.

Joe Vardon, a senior NBA writer for The Athletic, noted the timing. The Athletic is now part of The New York Times. Vardon reported that on Tuesday, the Knicks raised their first league championship banner since 1973. During that event, assistant coaches received boxes that did not contain rings. The team said those coaches will receive their rings at a later date.