The New York Knicks tried to phish their own employees with an offer of free championship rings, The New York Times reported on October 22.
The email went out in late September. "Congratulations, your Employee Championship Ring is here," it read, and it told recipients to click a link and choose between two ring designs. According to team sources cited by the Times, Madison Square Garden employees who clicked were required to attend a cybersecurity class. The newspaper tied the class to owner James Dolan's growing cybersecurity concerns. Dolan owns the Knicks, the New York Rangers, and Madison Square Garden.
Sending staff fake scam emails is a routine corporate exercise. The aim is to see who ignores the warning signs. Test messages often appear to come from the company itself but carry telltale flaws. Condé Nast, for one, sends its test messages from a misspelled domain, "condenest.com."
The Knicks version works differently. A misspelled address tests whether someone checks the details. A free ring tests whether wanting something beats checking at all. Real attackers lean on the same lever, with gifts, bonuses and perks standing in for the sports memorabilia, so a lure like this is arguably a more honest stand-in for what staff will face.
The consequence is also worth noting. Clickers got mandatory training rather than, as far as the account says, anything harsher. That is the usual logic of these exercises: a failed test becomes a lesson. The account does not say how many employees clicked, which leaves the obvious question unanswered: did the class change anything, or did it simply teach staff to distrust the next perk that shows up in their inbox?