Solo demo

Play solo

Pick a role. The other two are played by the computer along the model path — you will see their decisions in the “Team” tab. A full day of the crisis in about 90 minutes, at the same pace as in class, no sign-up. You can finish at any moment and get your debrief straight away.

Pick a scenario

Insider — NordBank customer data leakNordBank · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Tuesday 11:45. Email from a Krebs on Security researcher to the press-office inbox — attached file with 200 Nordbank customer records: first name, national ID (PESEL), account number, 90-day transaction history, last 4 digits of the card. Sample was published yesterday on DarkForums by user '@bankleaker'. Offered: 880,000 records for USD 350,000. The researcher asks for comment by 16:00. Initial SOC analysis uncovers a pattern: a former anti-fraud employee, Dariusz K. (employee ID 9234), who handed in his notice 3 weeks ago after a pay dispute, systematically exported customer data in small batches over the last 4 months via his legitimate CRM access (the audit log was never reviewed). The scenario tests: a leak without a 'classic' attacker (nobody to negotiate with), insider threat (governance failure), DORA + GDPR in parallel, the dilemma of 'whether to go after the former employee while the team still sympathises with him', and the B2B-client problem (the 5 largest clients have an SLA requiring 24h notification under threat of exit).Operation BlackCard — Ransomware at MediNetMediNet · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Tuesday 04:12 — the 'Akira' ransomware group encrypts the EMR/HIS systems in both MediNet data centres. Clinicians arriving for the morning shift in 40 clinics have no access to patient histories, prescriptions or lab results. At 04:30 the attackers publish a sample of 12,000 patient records on the darknet (national ID (PESEL), oncology diagnoses, paediatric data) and demand EUR 1.5M within 48h under threat of releasing 520k records. The first patients in the Warsaw emergency department have already been waiting 2 hours — among them a post-MI patient who does not know whether the clinician can administer a drug that will not interact with his standing regimen. The scenario tests: patient safety vs operational continuity, coordination with the competent health authority (Ministry of Health) and the Patient Rights Ombudsman, and the ransom dilemma in a sector where 'systems down' = 'patients die'.Operation Midas — Ransomware at NordBankNordBank · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Multi-stage ransomware attack with exfiltration of bank customer data. The attackers (the 'Midas Syndicate' group) encrypt key systems and threaten to publish 2M PII records unless a EUR 5M ransom is paid within 48h. The scenario tests in parallel: technical response, regulatory obligations (DORA/NIS2/GDPR/PSD2), communication with the media, and the ransom-payment dilemma.Exposed — MediNet medical-data leakMediNet · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). MediNet — a network of 40 outpatient clinics — wakes up on Tuesday morning to an alarming email from BleepingComputer: a journalist has a sample of 5,000 patient records with national IDs (PESEL), diagnoses and lab results. At the same time, a screenshot of a publicly accessible S3 bucket named 'medinet-backups-prod-emr-v2' appears on Twitter. The internal investigation quickly establishes the cause: a junior DevOps, 6 weeks earlier during a migration, briefly set ACL:public-read and forgot to revert it. The sample is genuine. The scenario tests: managing a crisis without an 'attacker' to negotiate with, the obligation to notify the DPA within 72h, notification of patients (GDPR art. 34) for special-category data, media pressure from the first minute, and accountability (whom to blame).

Your role

BoardSteers the company through the crisis and speaks for it: crisis team, statements, supervisory board, market disclosure.CISO / ITStops the leak and finds out what happened: cut the channel, preserve evidence, bring in DFIR.LegalOwns notifications and deadlines: financial regulator, CSIRT, data-protection authority, customers.

Nickname (optional)

Shown only in this session. Do not enter your real name.

By starting you accept the terms and the privacy policy. Some content in the game is written by AI — see how.