Cybersecurity: Fake Ring Emails Trigger Mandatory Training

Madison Square Garden employees who clicked a link in a simulated phishing email are required to attend a mandatory cybersecurity class. The training was ordered to address concerns raised by owner James Dolan regarding the organization's digital security posture.

The New York Times reported on Thursday that the message was sent to staff in late September. The email used the subject line, "Congratulations, your Employee Championship Ring is here." It instructed recipients to click a link to select between two ring designs.

Dolan owns the Knicks, the New York Rangers, and Madison Square Garden. The report, which cited team sources, stated that the training was intended to ease his growing concerns about cybersecurity. The organization used the email to test how well staff could identify suspicious messages.

Simulated phishing campaigns are common in large corporations. These tests often mimic internal communications but include subtle errors, such as misspelled domains. For example, Condé Nast, the parent company of Ars Technica, sends test messages from an address using the domain "condenest.com." It is unclear if the Knicks email contained similar obvious red flags.

The offer may have seemed plausible to staff members. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team employees typically receive championship rings. While staff rings are usually less elaborate than player versions, the practice is standard. The lure was strengthened by the fact that the Knicks recently won their first NBA championship in more than 50 years.

Vardon's reporting also covered a separate incident involving rings. On Tuesday, the Knicks raised their first league championship banner since 1973. During that ceremony, assistant coaches were handed boxes that did not contain rings. The team stated that the coaches are expected to receive their rings at a later date.

The cybersecurity training for staff who clicked the link is currently underway. The New York Times identified the email as a phishing test designed to measure staff vigilance against scams.