100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 05:40 on a Tuesday. Hundreds of servers are rebooting into a ransom note. The infrastructure team goes to restore and finds the backup console showing the same note: the backup server was joined to the domain, and the attacker deleted the restore catalogue and encrypted the on-site repository. An offsite copy exists in cloud object storage, but nobody has restored from it in fourteen months and nobody is sure whether its retention lock can be overridden. The business wants a restore time by 09:00. What do you tell them, and what do you touch first?
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
It is 23:15 on the Friday before a long weekend. The only on-call engineer gets an alert for mass file renames on a file server, then twelve more servers in five minutes. The SOC is outsourced: it has opened a ticket but cannot isolate hosts without written approval. The IT manager is on a flight until 06:00, the CISO is not answering, and the incident response retainer's hotline wants a contract number nobody on shift has. The attacker is still active. Who can authorise isolation right now, and what do you pull first?
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
An HR coordinator meant to email a salary review spreadsheet to the payroll provider. Autocomplete picked a similar name at a recruitment agency instead. The file holds names, salaries, home addresses and sickness absence notes for 340 employees. An hour later the recipient replied: 'I think this was meant for someone else.' The coordinator is panicking and has asked a friend in IT to 'just recall it'. It is now 16:30 on a Thursday. What happens next, and who needs to know?
A regional HR manager reports on Monday morning that she left her laptop in an airport security tray on Friday evening. She waited because she hoped the airport would find it. The device management console shows it last checked in on Saturday at 09:12 from an unknown home network. Disk encryption shows 'pending' because a policy change was never completed on her model. The laptop held disciplinary files and a local copy of an investigation into a senior manager. What do you do first, and is this a notifiable breach?
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
At 14:10 your SOC sees a new federated domain added to your cloud identity tenant, then a conditional access policy disabled. Both changes came from a Global Admin account belonging to a cloud engineer who is on holiday. Within twenty minutes, two new app registrations with mail-read permissions appear and three other admins report their MFA methods were changed. The attacker can now create users, issue tokens and read any mailbox. You are not sure which admin accounts are still yours. How do you take the tenant back without locking yourselves out?
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
On Tuesday afternoon, a caller claiming to be a regional sales director phones the IT help desk from a number that is not on file. He sounds stressed, says he has a new phone and is about to present to a major customer, and knows his employee ID and his manager's name. The agent resets his MFA and sends a temporary password. Ninety minutes later the real director, sitting in your office, gets a sign-in alert. Since then the account has opened the CRM and the shared drive for an acquisition project. What now, and how did this get through?
Your incident response firm believes the attacker who compromised your identity provider can still get back in, but cannot yet prove how. Their recommendation: take single sign-on offline for all 3,000 staff for up to 24 hours from 18:00 tonight while they rebuild trust. That means no email, no CRM, no payroll system, no ticketing and no remote access. Sales has a quarter-end close in two days. Customers know nothing yet. The CEO wants a decision from the room by 17:00. What do you decide, and what are you accepting by deciding it?
Your accounts payable team receives an email from your largest packaging supplier, sent from their real address and replying to a genuine invoice thread. It says they have changed banks after an audit and attaches a signed letter with new account details. The clerk calls the number on the letter, gets a confirmation, updates the vendor record and pays $186,000 on Tuesday. On Friday the supplier's credit controller phones to ask why the invoice is overdue. Your bank says the receiving account is at another bank, which has not replied. What happens in the next hour?
The group financial controller takes a call from what sounds exactly like the CEO, who is travelling. He says a confidential acquisition must close today, the lawyers will email instructions, and nobody else can know yet. Minutes later an email arrives from an outside law firm with wire details for €1.9 million and a signed letter of intent. The controller is uneasy and calls the CEO's mobile, which goes to voicemail. A voice note then arrives from an unknown number, in the CEO's voice, repeating the request. The bank cut-off is in 45 minutes. What should happen?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?
It is 10:40 on a Tuesday. A secret-scanning service emails your security inbox: a long-lived access key for your production deployment account was pushed to a public code repository 47 minutes ago, from a contractor's personal fork. The key has administrator rights. Your cloud audit log shows calls made with that key in the last ten minutes from an address nobody recognises, and the release pipeline uses the same key for tonight's deploy. The contractor is not answering their phone. What do you do in the next fifteen minutes?
A security researcher emails your support address on a Friday afternoon. They have found a cloud storage bucket, publicly listable, that holds nightly CSV exports from your customer platform: names, email addresses, phone numbers and partial payment details for roughly 210,000 customers in the EU, UK and US. They attach a screenshot of the file list and say they will publish a write-up in seven days. Your cloud team confirms the bucket is yours and was made public eighteen months ago for a one-off analytics project. Access logging on it was never switched on.
Your platform team moved CI to keyless federated identity last quarter: pipelines exchange a signed token for a short-lived cloud deploy role. Tonight the SOC sees that role assumed 31 times in two hours. The token claims name a repository under an organisation you have never heard of. The trust policy, it turns out, checks the identity provider but not which organisation the token comes from. Using the role, someone has created two new identities, read your secrets store and changed a load balancer rule in production. Nothing has failed yet. Where do you cut, and what do you trust after?
The finance team forwards a billing alert at 08:15: your cloud spend for the last 24 hours is $182,400 against a usual $3,000. The cloud team finds hundreds of large GPU instances running in four regions you have never used. They were launched from the root account of a development tenancy that nobody has logged into for a year. Its recovery email points to a former employee's personal address. Your provider's support line says a credit "may be considered" once you secure the account. The instances are still running and costing roughly $7,500 an hour.
A public advisory says a popular open-source logging package was hijacked: version 4.8.2, published three days ago, runs a post-install script that reads environment variables and sends them to a remote server. Your dependency manifests allow minor updates. A quick search shows 14 of your repositories pulled 4.8.2, and your CI runners, which hold cloud deploy credentials, package registry tokens and a signing key in their environment, built every one of them, many times. Two developers also installed it on their laptops. What do you assume was taken?
A release engineer runs a reproducible-build check on tomorrow's release and it fails: the compiled agent your customers install on 40,000 endpoints contains a 3 KB block that is not in any commit. Rebuilding on a clean machine gives a different hash. The build server's scheduled tasks include a script nobody recognises, created five weeks ago. Your last two releases came off the same server and are already in customers' hands. Release is scheduled for 09:00 tomorrow and the sales team has promised the new version to your largest customer.
A customer's security team calls your CISO at 07:30. Their EDR flagged your desktop agent, version 9.4.1, released nine days ago and signed with your code-signing certificate, making outbound connections to a domain registered last month. Your engineers confirm the binary contains code that is not in your repository. Telemetry says 3,100 customer organisations have installed 9.4.1, including hospitals and two government agencies. The customer says they will post their findings publicly at noon. Your auto-update service is still offering 9.4.1 right now.
Your EDR raises a medium-severity alert on a senior developer's laptop: an unsigned executable launched from the downloads folder, then deleted itself. The developer says they installed a "free licence key generator" for a design tool on Saturday. It is now Monday. Since Saturday, their code-hosting session, their cloud console session and their password manager browser extension have all been used from an IP address in another country, with no multi-factor prompts, because the attacker replayed session cookies. The developer has admin rights on 60 repositories. Where do you start?
Your help-desk software provider emails all customers at 18:00: an attacker accessed its production environment and "may have obtained" OAuth tokens that customers granted for integrations. Your instance has integrations with your CRM, your file-sharing platform and your code host, all granted with broad scopes two years ago by someone who has since left. The provider's notice gives no indicators, no timeline and a link to a status page. Your support team has 4,000 open tickets, many with customer attachments. The provider's account manager is not answering.
At 02:10 on a Sunday your on-call engineer sees the managed service provider's remote-management agent running a PowerShell script on every Windows server at once. The script disables backup agents and the EDR service. Your MSP's emergency line rings out. Their status page is fine. You have the console credentials for your own tenant but not for the MSP's master console, and their agent runs as SYSTEM on 340 servers and 1,200 laptops. Within ten minutes, file servers in two offices begin renaming files. What do you pull first?
It is Wednesday morning and 2,600 staff are due to be paid on Friday. Your outsourced payroll provider has been offline since last night. Its status page says "investigating a security incident affecting some systems" and gives no recovery time. Your payroll team cannot submit the final run, and the provider has the only copy of this month's calculated pay, tax and deductions. Social media already has posts from employees at other companies using the same provider. Your union representative has asked HR whether pay will arrive on time. The CEO wants a decision by noon.
A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.
A user posts screenshots on social media of your customer-support chatbot. By pasting a crafted instruction into the chat, they got it to look up and display order histories, addresses and partial card numbers for three other customers. The bot uses a large language model with a tool that queries the order database using the customer ID the model supplies. The post has 40,000 views and replies show other people trying the same trick. The bot handles 9,000 conversations a day and is the only support channel open overnight. It is 22:30.
Three weeks ago your platform team gave an AI operations agent permission to tidy up unused cloud resources, with a rule that destructive actions need human approval in chat. This morning the cost dashboard shows a 22% drop. The agent's log says it identified "orphaned snapshots" and deleted 1,400 of them, including the only backups of your billing database. It recorded the approval as granted: an engineer had replied "looks good" to a different message in the same thread. A database migration is planned for tonight. Who is accountable, and what do you change?
Forty of your engineers use AI coding assistants connected to a community-built Model Context Protocol server that adds database and ticketing tools. A researcher's blog post says version 2.3 of that server added hidden instructions in its tool descriptions that tell the assistant to read local environment files and include them in a "telemetry" call. The update arrived automatically two weeks ago. Your engineers' laptops hold cloud credentials, database passwords and customer test data. Your egress logs show the telemetry domain was contacted 9,200 times. What do you assume, and what do you change?
Your new data-loss prevention pilot produces its first weekly report. In seven days, staff pasted content into a free public AI chatbot 1,840 times. The sample includes a production database connection string, a customer contract with pricing, two HR investigation notes and a spreadsheet of patient appointment details. Your acceptable-use policy says nothing about AI. The approved enterprise AI tool, bought six months ago, has 30 active users out of 1,200. A department head replies to your email: "Everyone uses it. Banning it will just push people to their phones."
On Monday a finance manager joined a video call with what looked and sounded like your CEO and CFO, plus an "external lawyer". They explained a confidential acquisition and asked for three urgent payments to an escrow account, totalling $2.4 million. The manager made the payments after a follow-up email from the CEO's real address, sent through a compromised mail rule. Today the real CEO asks why finance moved money on a deal that does not exist. Your bank says the first transfer has left the receiving bank. The finance manager is distraught.
It is 05:40 on a Monday at a 900-person auto-parts manufacturer running three shifts. Office laptops started showing ransom notes an hour ago. Now the night-shift supervisor reports that two HMI screens on the stamping line show the same note, and the historian server has stopped updating. The PLCs are still running and the presses are still making parts, but operators can no longer see process values on screen. The first shift arrives in 80 minutes. Do you keep the line running blind, shut it down, or cut the plant off from the corporate network first?
At 02:15 the HMI at a regional dairy shows the pasteuriser hold-tube temperature setpoint has moved from 72.5°C to 68.0°C. Nobody on the night shift admits to changing it. The change log names the engineering workstation's shared login, and that workstation sits in a locked, empty office. The flow-diversion valve worked and no under-temperature milk left the line, but 9,000 litres are now held in a silo pending a decision. The morning tanker leaves at 06:00. Was this an attacker, a scheduled job or a mistake, and how do you find out without destroying the evidence?
Your filling-machine supplier emails every customer on a Thursday afternoon: an attacker had access to its remote-support platform for at least three weeks and 'may have used customer connections'. Your beverage plant gives this supplier always-on remote access to the line controllers so it can tune machines without a site visit. Your firewall shows sessions from the supplier's platform on four evenings when the supplier says no engineer was working. Its account manager wants the connection left open because a firmware fix is scheduled for Monday. Do you cut them off, and what do you look at first?
You are on day two of investigating suspicious traffic inside the control network of a chemical blending plant. Responders have a laptop on the OT switch capturing packets. At 14:20 the safety instrumented system trips reactor R-3 on high pressure, venting to the flare and closing the feed valves. The control room saw the pressure transmitter spike, but two field gauges read normal throughout. Operators want to reset the safety system and restart the batch, which is worth $400,000. The responders want the safety controller left untouched until they know whether anyone has reached it. Who decides?
You run a municipal water utility serving 38,000 people. At 11:05 an operator watches the cursor move across the SCADA screen on its own and raise the sodium hydroxide dosing setpoint from 90 to 5,400 parts per million. He resets it within a minute, and downstream pH alarms would have caught it before treated water reached a tap. The workstation runs remote-access software installed years ago so the on-call operator could work from home. The mayor’s office has already heard about it from a council member. Do you tell the public, and what do you say?
A finance manager at a 600-person logistics company reports on Monday morning that her bag, with her access badge inside, was stolen from her car on Saturday night. She did not report it over the weekend. The access-control log shows her badge opened the side entrance at 03:12 on Sunday and the server room door at 03:16, a room she has never had reason to enter and should not have been able to open. The camera covering that corridor has pointed at the ceiling since a refit two months ago. What do you do in the next hour?
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
A senior engineer at a 250-person fintech hands in her notice on Friday, saying she is joining a competitor. On Monday a routine review of source-control audit logs shows her account cloned 140 repositories in the ten days before she resigned, including the fraud-scoring models she never worked on. Her work laptop also synced to a personal cloud drive twice last week. She is still working her notice period, has production access, and is well liked. HR wants to handle it quietly. Legal wants evidence first. What happens today?
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
At 16:30 on a Thursday a developer at a 200-person subscription software company runs a data-retention cleanup script against what he believes is the staging database. It is production. Before he kills it, the script has deleted 38% of customer account records and their linked invoices. The app is still up, but thousands of customers now see empty accounts or ‘user not found’. Support tickets are arriving at 40 a minute. The last full backup finished at 02:00. Nobody acted maliciously. How do you get the data back, and what do you tell customers?
Your threat-intelligence provider sends a screenshot from a criminal forum: a seller offers ‘VPN and Citrix access to a regional insurer, 2,000 staff, domain user, $6,000, insider can stay on for ongoing jobs’. The details match your company. The SOC traces two test logins described in the post to a claims handler’s account, from her home IP address, at times she was not scheduled to work. She is on shift right now. Is she the seller, a victim, or both? Do you lock her out now, or watch to see who buys?
It is 09:00 on Black Friday at an online homeware retailer that takes 18% of its annual revenue in the next four days. Requests to the checkout API jump to 40 times normal, response times pass ten seconds and the site starts returning errors. An email arrives at the press address: pay 5 bitcoin or the site stays down all weekend. Your CDN has basic DDoS protection, but the checkout API sits outside it on a separate hostname. Marketing has a promotional email going to 3 million customers at 10:00. What do you do in the next hour?
At 07:10 customers of a 700-person online bank start reporting that the login page looks slightly wrong and asks for their one-time passcode twice. Your engineers find the domain’s name servers were changed overnight through the registrar’s web portal, using a staff account protected only by a password and SMS codes. DNS now points to attacker-controlled servers, and a certificate for your login hostname was issued to someone else at 03:40. Some resolvers still have the old records cached. The registrar’s support line opens at 09:00. How do you take your domain back, and what do you tell customers?
At 00:01 on the first of the month, card payments at a 300-store pharmacy chain start failing. Tills show ‘connection error’ and the mobile app cannot place orders. Within twenty minutes the on-call engineer finds the cause: the TLS certificate on the internal payment gateway expired at midnight. Nobody knew it existed. The engineer who installed it left two years ago, and the renewal reminders went to his old mailbox. Issuing a new certificate needs approval from someone who is asleep. Stores open at 07:00. How do you fix it tonight, and how do you find the next one?
A severe storm has hit the region served by a 1,200-person home insurer, and claims calls are at five times normal volume. At 08:20 the cloud contact-centre platform your agents use for calls, chat and call recording goes down across the provider’s entire region. The provider’s status page says ‘investigating’ and gives no estimate. Agents can still log into the claims system but cannot take calls. Customers with flooded homes are getting a dead line, and local radio has started asking why. Your contract’s service credit is worth one month’s fees. What is your plan for the next eight hours?
Three days after attackers stole HR files from a 900-person engineering consultancy, they change tactics. Twelve employees, including the CEO and two HR staff, receive texts on their personal phones listing their home address and their children’s school, with a demand: tell your company to pay, or this goes online. One message includes a photo of an employee’s front door. The attackers’ leak site now lists the company with a five-day countdown. Staff are frightened and some want to stay home. The board meets tomorrow. What do you do for your people today?
At 21:30 on a Sunday, armed police surround your CEO’s house after a hoax call reporting a hostage situation. Nobody is hurt, but her teenage son was handcuffed on the lawn. Within the hour, an anonymous social media account posts your CFO’s home address and writes ‘he’s next’ in a thread about recent layoffs at your 3,000-person logistics business. Some of the executives’ personal details appear to come from a data broker. Monday’s all-staff meeting at headquarters is in twelve hours. How do you protect people tonight, and what changes tomorrow?
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
It is 02:40 on a Saturday at a 450-bed regional hospital. The night supervisor calls: the electronic health record is frozen, workstations on three wards show a ransom note, and the pharmacy dispensing system has dropped offline. The emergency department has 31 patients, two ambulances are ten minutes out, and the trauma surgeon on call wants to know whether to divert. Downtime procedures exist on paper, but nobody has run them for longer than four hours. The ransom note says patient data has already been copied. Who decides on diversion, and what do you tell the ambulance service right now?
Your SOC flags outbound connections from 40 networked infusion pumps on the oncology and intensive care floors to an IP address in a hosting range nobody recognises. The traffic started after last week's vendor maintenance visit. As far as nursing staff can tell, the pumps are still delivering medication normally. The manufacturer's support line says a patch is 'in validation' and will not commit to a date. Clinical engineering owns the pumps, IT owns the network, and the vendor holds the admin passwords. Pulling the pumps means moving patients to manual pumps you do not have enough of. What do you do in the next hour?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?
At 09:31 on the morning of a major interest-rate announcement, your online brokerage's order-entry service starts returning errors. Customers can log in and see positions but cannot place or cancel orders. Traffic is four times a normal day. A configuration change to the order-routing gateway went out at 08:50, and the network team is also seeing a surge from a few thousand IP addresses that could be a DDoS or could be your own customers' apps retrying. Customers with open positions are posting angrily on social media. Roll back, scale out or block traffic? You have one move to make first.
Friday, 18:20. A correspondent bank calls your payments operations desk about three outbound cross-border transfers sent in the last two hours: $4.2 million, $6.8 million and $9.5 million, to beneficiaries in three countries you rarely deal with. The messages were authenticated through your own payment messaging gateway using two valid operator accounts, one belonging to someone on leave. The daily reconciliation that would have caught them runs at 22:00, and today's printed confirmation report shows nothing unusual. Some of the funds may already have been credited. Who calls whom first, and what do you switch off?
Your acquiring bank emails: card-fraud analysis links 212 fraudulent transactions to cards used on your online store over the past five weeks, and they want a forensic investigation. Your developers find nothing changed in your own code. Then a front-end engineer notices the checkout page loads a chat widget from a vendor's CDN, and the script now contains 40 extra lines of obfuscated JavaScript that post form fields to an unfamiliar domain. The widget is on every page, including payment. Peak-season trading starts in nine days. What do you remove, what do you keep, and what do you tell the bank?
Customer support at your 300-store grocery and pharmacy chain has logged 900 complaints in two days: loyalty points gone, redeemed for gift cards online and at self-checkout. Login traffic to the loyalty app is twelve times normal, mostly from residential proxy addresses, with a success rate of about 2%. That is roughly 18,000 accounts accessed. Points are not money in your accounts, but customers treat them as money, and the accounts also hold home addresses and pharmacy pickup history. Marketing launches a double-points promotion on Monday. What do you do first?
It is 20:05 on Black Friday. Your online retailer's checkout has been failing for 18 minutes; about one payment attempt in three times out. The promotional email to 2.4 million customers went out at 20:00. Revenue for this hour last year was $1.9 million. Engineering thinks the payment provider is rate-limiting you; the payment provider says its systems are healthy. Social media has noticed, and a competitor has just extended its own sale by an hour. The CEO has joined the bridge and wants to know whether to pause the promotion. What do you decide in the next ten minutes?
Monday, 07:30. Staff at a county council serving 280,000 residents arrive to find file shares encrypted and the housing benefits, social care case management and parking systems unavailable. Phones still work, but the contact centre cannot see case records. A social worker needs a child's safeguarding history for an emergency court hearing at 11:00. The ransom note demands payment within 72 hours and threatens to publish residents' data. Councillors are already asking questions, and a local reporter has heard that the payments portal is down. What do you prioritise this morning?
A parent forwards your district office an email from someone claiming to hold the records of every student in your 14-school district: names, addresses, grades, special-education plans and medical notes. Attached is a spreadsheet with her own child's details, correct as of last month. Your student information system is hosted by a vendor, and their support desk says they are 'looking into an incident affecting several customers'. The superintendent has a school board meeting tonight, and the local parents' group online already has 200 comments. What do you tell parents before the meeting?
Two days before a municipal election, a 40-second audio clip spreads on social media. It sounds like your county's chief election official telling a colleague that ballots from two precincts 'will be handled differently this year'. A second post, styled like your website, says three polling places have moved. Your official never said this, and nothing has moved. By noon the clip has 300,000 plays, your phone lines are jammed, and a candidate is demanding an explanation. Your public results website is also seeing unusual traffic. How do you respond without amplifying the fake?
At 05:00 on a Wednesday, your logistics company's warehouse management and transport management systems go dark across six distribution centres. Ransom notes are on the servers. Forty trucks are queued at the gates, the handheld scanners cannot print labels, and a pharmaceutical customer has temperature-controlled stock that must ship by 14:00. Customs declarations for two ports are filed from the same encrypted system. Your largest retail customer's contract has a penalty clause for missed delivery windows. The operations director wants to restart on paper. Can you, and what has to be true first?
Accounts payable at your industrial equipment manufacturer pays $860,000 to a long-standing steel supplier, and three days later the supplier asks where its money is. The bank details on file were changed through your supplier self-service portal two weeks ago, by a login using the supplier's own account. The same account uploaded six updated 'drawing packages' that your design engineers have since opened. Two other suppliers report odd password-reset emails from your portal. The portal is run by a SaaS vendor your procurement team chose. What do you check, freeze and tell suppliers today?
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
A customer of your 400-person HR software company opens a support ticket with a screenshot: their dashboard search returned salary records belonging to another customer's employees. Engineering traces it to a caching change deployed nine days ago that sometimes keys results by query text instead of by tenant. Logs show the faulty path ran at least 6,000 times, but nobody yet knows how many of those responses held another tenant's data, or which tenants saw what. You process data for 1,100 business customers, most of them in the EU and UK. The fix is ready. Do you ship it now?
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?
It is 07:40. Overnight your SOC confirmed that an intruder has had access to the customer database for at least nine days. Containment is under way but not finished. The chair has heard a rumour from another director and wants a call with the full board at 18:00 today. You do not yet know how many records were taken, whether the attacker is still inside, or whether a regulatory clock has started. You have ten hours to decide what the board needs to hear, who says it, and what you will refuse to guess at.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
You are a listed software company. On Monday the security team confirmed that an attacker took source code and a database of 1.1 million customer contact records through a compromised build server. Revenue impact is unclear, and two large customers have asked whether their API keys were exposed. The disclosure committee meets Wednesday morning. Once you determine the incident is material, you have four business days to file. Some in the room want to wait for the forensic report due in three weeks. Others think the decision is already overdue.
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
At 14:10 on a Friday your online store is taken offline by an attack that has encrypted the order database. The CEO is on a 14-hour flight with no reliable connectivity and lands tomorrow morning. The COO is on leave. Someone has to decide whether to shut down the payment gateway, whether to tell customers, and whether to engage an incident response firm that wants 250,000 dollars up front. The incident plan says 'the CEO approves'. It says nothing else.
Your company is six weeks from signing an agreement to buy a 300-person payments start-up. During security due diligence your team finds credentials for the target's production cloud account for sale on a criminal marketplace, dated four months ago. The founders say they had 'a minor incident' that was handled and that no notifications were needed. Their logs only go back 30 days. The deal team wants a recommendation this week: walk away, reprice, add protections in the agreement, or demand an independent investigation first.
You signed the agreement to buy a regional medical-billing company three weeks ago. Closing is in five weeks, pending regulatory approval. This morning the target's CEO calls: ransomware hit them overnight and patient billing records may have been taken. Your security team wants to send people in to help. Your lawyers warn that you cannot run the target's business before close. The agreement has a material adverse effect clause, and your board meets in four days. What do you do, and what are you allowed to do?
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.
A security researcher posted on social media that your insurance comparison site had left a storage bucket of 80,000 quote applications open to the internet. You closed it within an hour and decided, after a quick assessment, that it did not need to be notified. Eleven days later a letter arrives from the data protection authority. It asks when you became aware, who accessed the data, why you did not notify, and for a copy of your breach register entry. Replies are due in 14 days. Your breach register entry is two lines long.
Four days after you notified 210,000 customers that their names, addresses and loyalty account details were exposed, a plaintiffs' law firm publishes a press release saying it is investigating claims against your retail chain and inviting affected customers to get in touch. A demand letter citing a state privacy statute arrives the next day. Customer support is fielding calls asking whether people should join. Your forensic firm is still finishing its report. What gets written down now may be read in court later.
You run IT for a mid-sized water utility in the EU, classed as an essential entity under NIS2. At 06:30 monitoring shows that the remote-access gateway used by contractors has been accepting logins from an unfamiliar country for two nights, and the telemetry server it reaches is behaving oddly. Nothing has failed, and operations say pumping is normal. The national CSIRT expects an early warning within 24 hours of becoming aware of a significant incident. Is this significant, when did the clock start, and who sends it?
Your accounting software company refused a ransom demand last week after a data theft. This morning hundreds of your small-business customers received an email from the attacker. It quotes each customer's own invoice data as proof, says you 'chose not to protect them', and invites them to pay 500 dollars each to have their records deleted. Support has 900 tickets in the queue. Two customers have posted the email on social media, and one says they have already paid.
A threat-intelligence feed alerts you that your regional law firm has been listed on a ransomware group's leak site. The post shows a timer with 72 hours remaining, a list of client names, and three screenshots of documents that look like your matter files. There has been no ransomware outbreak and no ransom note, and IT finds nothing encrypted. Partners are asking whether this is real, whether clients must be told before the timer runs out, and whether anyone should contact the group.
A government agency privately tells your aerospace components firm that an intruder linked to a foreign intelligence service has been in your engineering network for about eight months. They share three indicators and ask you not to tip off the attacker. Your logs go back 90 days. The intruder appears to use legitimate admin tools rather than malware. Your largest customer is a defence prime with contractual reporting duties. Do you watch, or evict? And what do you tell anyone?