For facilitators

Run the exercise with your group

Pick a scenario and we create the session on our server. You get a code and a QR code for participants and a secret link to the facilitator panel. No account, nothing to install, no fees.

1
Create a session
Scenario, difficulty and number of teams. It takes a minute.
2
Show the code
Put the QR code on the projector. Participants join from a phone or laptop and pick a role.
3
Start
Every role needs at least one person. The clock starts for all teams at once.
4
Discuss the debrief
At the end every team gets a scored debrief, and you see the debriefs of all teams.

A session expires 2 hours after the game is due to end, so create it just before class. Up to 30 people per team.

Scenario

Insider — NordBank customer data leakNordBank · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Tuesday 11:45. Email from a Krebs on Security researcher to the press-office inbox — attached file with 200 Nordbank customer records: first name, national ID (PESEL), account number, 90-day transaction history, last 4 digits of the card. Sample was published yesterday on DarkForums by user '@bankleaker'. Offered: 880,000 records for USD 350,000. The researcher asks for comment by 16:00. Initial SOC analysis uncovers a pattern: a former anti-fraud employee, Dariusz K. (employee ID 9234), who handed in his notice 3 weeks ago after a pay dispute, systematically exported customer data in small batches over the last 4 months via his legitimate CRM access (the audit log was never reviewed). The scenario tests: a leak without a 'classic' attacker (nobody to negotiate with), insider threat (governance failure), DORA + GDPR in parallel, the dilemma of 'whether to go after the former employee while the team still sympathises with him', and the B2B-client problem (the 5 largest clients have an SLA requiring 24h notification under threat of exit).Operation BlackCard — Ransomware at MediNetMediNet · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Tuesday 04:12 — the 'Akira' ransomware group encrypts the EMR/HIS systems in both MediNet data centres. Clinicians arriving for the morning shift in 40 clinics have no access to patient histories, prescriptions or lab results. At 04:30 the attackers publish a sample of 12,000 patient records on the darknet (national ID (PESEL), oncology diagnoses, paediatric data) and demand EUR 1.5M within 48h under threat of releasing 520k records. The first patients in the Warsaw emergency department have already been waiting 2 hours — among them a post-MI patient who does not know whether the clinician can administer a drug that will not interact with his standing regimen. The scenario tests: patient safety vs operational continuity, coordination with the competent health authority (Ministry of Health) and the Patient Rights Ombudsman, and the ransom dilemma in a sector where 'systems down' = 'patients die'.Operation Midas — Ransomware at NordBankNordBank · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). Multi-stage ransomware attack with exfiltration of bank customer data. The attackers (the 'Midas Syndicate' group) encrypt key systems and threaten to publish 2M PII records unless a EUR 5M ransom is paid within 48h. The scenario tests in parallel: technical response, regulatory obligations (DORA/NIS2/GDPR/PSD2), communication with the media, and the ransom-payment dilemma.Exposed — MediNet medical-data leakMediNet · starter scenario — first 24hThe game takes about 90 minStarter scenario — first day of the crisis (24h game time). MediNet — a network of 40 outpatient clinics — wakes up on Tuesday morning to an alarming email from BleepingComputer: a journalist has a sample of 5,000 patient records with national IDs (PESEL), diagnoses and lab results. At the same time, a screenshot of a publicly accessible S3 bucket named 'medinet-backups-prod-emr-v2' appears on Twitter. The internal investigation quickly establishes the cause: a junior DevOps, 6 weeks earlier during a migration, briefly set ACL:public-read and forgot to revert it. The sample is genuine. The scenario tests: managing a crisis without an 'attacker' to negotiate with, the obligation to notify the DPA within 72h, notification of patients (GDPR art. 34) for special-category data, media pressure from the first minute, and accountability (whom to blame).Insider — NordBank customer data leakNordBank · full 72h crisisThe game takes about 3 hFull crisis — 72h game time. Tuesday 11:45 — email from a Krebs on Security researcher with a sample of 200 Nordbank customer records: first name, national ID (PESEL), account number, 90 days of transaction history. Sample published on DarkForums by '@bankleaker'. Sale offer: 880,000 records for USD 350,000. SOC establishes the pattern: it was the work of anti-fraud analyst Dariusz K. (notice 3 weeks ago, pay dispute). Covers the full 72h of the crisis: from detection, through the first-24h media and regulatory avalanche, to days 2-3 with the GDPR 72h deadline. Tests: crisis management without a 'classic attacker', insider threat (governance failure), DORA + GDPR in parallel, the dilemma of publicly accusing a former employee before a judgement.Operation BlackCard — Ransomware at MediNetMediNet · full 72h crisisThe game takes about 3 hFull crisis — 72h game time. Tuesday 04:12 — the 'Akira' ransomware group encrypts the EMR/HIS systems in both MediNet data centres. Clinicians arriving for the morning shift in 40 clinics have no access to patient histories, prescriptions or lab results. At 04:30 the attackers publish a sample of 12,000 patient records on the darknet (national ID (PESEL), oncology diagnoses, paediatric data) and demand EUR 1.5M within 48h under threat of releasing 520k records. Covers the full 72h of the crisis: from detection, through the media and regulatory avalanche of day one, into days 2-3 with the GDPR (72h) deadlines. Tests: patient safety vs operational continuity, coordination with the competent health authority (Ministry of Health) and the Patient Rights Ombudsman, and the ransom dilemma in a sector where 'systems down' = 'patients die'.Operation Midas — Ransomware at NordBankNordBank · full 72h crisisThe game takes about 3 hFull crisis — 72h game time. Multi-stage ransomware attack with exfiltration of bank customer data. The attackers (the 'Midas Syndicate' group) encrypt key systems and threaten to publish 2M PII records unless a EUR 5M ransom is paid within 48h. Covers the full 72h crisis: from detection, through the day-1 media and regulatory cascade, to days 2-3 with the GDPR deadlines (72h). Tests in parallel: technical response, regulatory obligations (DORA/NIS2/GDPR/PSD2), communication with the media and customers, and the ransom-payment dilemma — with the constraint that weekend SWIFT transfers are suspended.Exposed — MediNet medical-data leakMediNet · full 72h crisisThe game takes about 3 hFull crisis — 72h game time. MediNet — a network of 40 outpatient clinics — wakes up on Tuesday morning to an alarming email from BleepingComputer: a journalist has a sample of 5,000 patient records with national IDs (PESEL), diagnoses and lab results. At the same time, a screenshot of a publicly accessible S3 bucket named 'medinet-backups-prod-emr-v2' appears on Twitter. The internal investigation quickly establishes the cause: a junior DevOps, 6 weeks earlier during a migration, briefly set ACL:public-read and forgot to revert it. The sample is genuine. Covers the full 72h of the crisis: from detection, through the media and regulatory avalanche of the first day, to days 2-3 with GDPR (72h) deadlines. The scenario tests: managing a crisis without an 'attacker' to negotiate with, the obligation to notify the DPA, notification of patients (GDPR art. 34) for special-category data, media pressure from the first minute, and long-term accountability.

Level

easy — every deadline visible from the startmedium — deadlines reveal themselves during the game

Roles played by the computer

BoardCISO / ITLegal

When a team is short of people: the computer takes that role's decisions from the reference path. Whoever joins the role takes it over.

Number of teams

Each team plays separately with its own code. Ideally 3–6 people per team.

By creating a session you accept the terms and the privacy policy.

Want to use CSIRT-Sim regularly, without limits and on your own server? The code is open: installation guide Questions and collaboration: contact@ksiezopolski.pl.