Knicks Staff Targeted With Fake Championship Ring Offer in Phishing Test, Report Says

The New York Knicks organization sent employees a fake email offering free championship rings as a test of how well staff can spot scams, The New York Times reported on Thursday.

The message went out in late September. Its subject line read, "Congratulations, your Employee Championship Ring is here," and it told recipients to click a link to choose between two ring designs.

According to the report, which cited team sources, Madison Square Garden employees who clicked the link were required to attend a mandatory cybersecurity class. The training was reportedly meant to help ease some of owner James Dolan's growing concerns about cybersecurity. Dolan owns the Knicks, the New York Rangers and Madison Square Garden.

Simulated phishing messages are a common tool at large companies, which use them to see which workers overlook warning signs in suspicious email. Such tests often appear to come from the employer itself but contain clues that give them away. Ars Technica's parent company, Condé Nast, for example, sends test messages from an address with a misspelled domain, "condenest.com."

It is unclear whether the Knicks email had any obvious red flags of that kind, such as a misspelled domain. The offer was not far-fetched either. Joe Vardon, senior NBA writer for The Athletic, noted that most employees of NBA teams typically receive rings, even if theirs are not as elaborate or costly as the players' versions. The Athletic was acquired by The New York Times in 2022 and later merged into the parent news organization.

The lure also carried extra weight because the Knicks have just won their first NBA championship in more than 50 years. Staff could be forgiven for being fooled, or at least irritated, by a fake offer tied to that milestone.

Vardon's article focused mainly on a different ring-related episode. On Tuesday, the Knicks raised their first league championship banner since 1973, and the team's assistant coaches were handed boxes with no rings inside. They are expected to receive their rings at a later date.