Knixns Owner Dolan Orders Security Training After Staff Click Fake Ring Offer

Madison Square Garden employees who clicked a link in a fake championship ring email are now required to complete a mandatory cybersecurity course. The exercise, orchestrated by the New York Knicks organization, served as a live test of staff vigilance against social engineering attacks.

The phishing message was distributed to staff in late September. The email used the subject line, 'Congratulations, your Employee Championship Ring is here,' and instructed recipients to select between two ring designs via a hyperlink. The offer leveraged the team’s recent first NBA championship in more than 50 years, making the prospect of a complimentary ring plausible for many employees.

James Dolan, the owner of the Knicks, the New York Rangers, and Madison Square Garden, reportedly ordered the training to address growing concerns about the organization's cybersecurity posture. Dolan oversees the financial and operational aspects of these major New York sports assets.

Simulated phishing campaigns are a standard risk management tool for large corporations. Companies use these tests to identify which employees overlook warning signs in suspicious correspondence. A common tactic involves sending messages from addresses with slightly misspelled domains, a method previously employed by Condé Nast, the parent company of Ars Technica.

It is currently unclear if the Knicks email contained such obvious red flags as a misspelled domain. Joe Vardon, a senior NBA writer for The Athletic, noted that the offer was not far-fetched for most team employees, who typically receive rings of varying value following a title win. The Athletic, acquired by The New York Times in 2022, has since merged into that news organization.

The incident follows a separate ring-related event on Tuesday. The Knicks raised their first league championship banner since 1973. During the ceremony, assistant coaches received boxes that did not contain rings. The team stated that these coaches are expected to receive their rings at a later date.

The mandatory training requirement applies specifically to those who clicked the link in the September email. The exercise aims to reinforce internal security protocols across the Madison Square Garden employee base.