James Dolan mandates cybersecurity training after Knicks staff clicked fake ring email

Madison Square Garden employees who clicked a link in a fake email offering free championship rings were required to attend a mandatory cybersecurity class, according to a report by The New York Times published on Thursday. The New York Knicks organization sent the simulated phishing message to staff in late September as part of a security test.

The email subject line read, "Congratulations, your Employee Championship Ring is here." The message instructed recipients to click a link to select between two ring designs. Team sources told The New York Times that the training was implemented to address growing concerns held by owner James Dolan regarding the organization's digital security. Dolan also owns the New York Rangers and Madison Square Garden.

This type of internal test is common among large corporations. Employers use these simulations to identify which workers overlook warning signs in suspicious communications. The messages often appear to originate from the company itself but include subtle clues that expose them as tests. Condé Nast, the parent company of Ars Technica, sends similar test messages from an address with a misspelled domain, "condenest.com." It remains unclear if the Knicks email included similar obvious red flags.

The specific lure used in this test carried extra weight for staff members. The Knicks recently won their first NBA championship in more than 50 years. Joe Vardon, a senior NBA writer for The Athletic, noted that most NBA team employees typically receive rings, even if they are less elaborate than the players' versions. Vardon wrote that the offer was not far-fetched given this standard practice.

The timing of the test coincided with a separate ring-related event for the team. On Tuesday, the Knicks raised their first league championship banner since 1973. During that ceremony, the team's assistant coaches received boxes that did not contain rings. They are expected to receive their rings at a later date.

Vardon's article for The Athletic focused primarily on that banner raising ceremony and the empty boxes handed to assistant coaches. The phishing test and the mandatory training occurred around the same time, adding to the ring-centric focus within the organization. The New York Times report cited team sources for details on the cybersecurity class and Dolan's involvement in the decision to mandate the training for those who clicked the link.