Two Staff Members Clicked the Link; Now They Must Attend Class

Two Madison Square Garden employees clicked a suspicious link in late September. Their mistake triggered a mandatory cybersecurity class for all staff. The exercise was designed to test how well the organization protects its digital infrastructure.

The test email arrived with the subject line, "Congratulations, your Employee Championship Ring is here." It instructed recipients to select one of two ring designs. The New York Times reported on Thursday that the message served as a phishing drill for the Knicks organization.

Owner James Dolan ordered the training to address growing concerns about security. Dolan controls the Knicks, the New York Rangers, and the arena. He used the simulated attack to identify which workers might overlook warning signs in future communications.

The lure was specific to the team's recent success. The Knicks won their first NBA championship in more than 50 years. Senior NBA writer Joe Vardon noted that employees typically receive rings, even if they are less elaborate than the players' versions. This context made the fake offer appear plausible to staff.

Simulated phishing is a standard practice in large companies. Firms often send test messages from slightly altered domains to catch untrained employees. For example, Condé Nast, the parent company of Ars Technica, uses the address "condenest.com" for its own tests. It is unclear if the Knicks email included similar red flags.

The timing of the drill coincided with other ring-related news. On Tuesday, the Knicks raised their first league championship banner since 1973. Assistant coaches received boxes that did not contain rings. The team plans to distribute those rings at a later date.

The cybersecurity class remains in effect for those who clicked. No further details were released about the specific content of the training or the number of employees who passed the test.