Cloud Collapse: The 30-Day Wargame
07:40. Stratos Cloud stops answering. An hour later it says every byte of customer data, in every region, is gone for good. Your email, files, sign-in, code and production all lived there. Lead a hospital, a bank, a council or a startup through the next 30 days: keep people safe, keep the money moving, beat the fraudsters who follow every crisis, and find out how much of your data you can bring back.
- BREAKING: Stratos Cloud services down in every region
- Stratos statement: "customer data in all regions has been lost and cannot be recovered"
- Check-in kiosks go blank at airports as airline systems fail
- Card payments failing at some shop tills
- Stratos status page unreachable; company posts on a third-party social network
- Hour 1
- Hour 6
- Day 1
- Day 3
- Day 7
- Day 30
Briefing · fictional scenario
Stratos Cloud, a fictional hyperscale provider, is about to lose every byte of customer data in every region, for good. You will lead one organisation through the next 30 days.
TL;DRWhat this wargame is
6 points
- A free browser wargame: Stratos Cloud, a fictional hyperscale provider, permanently loses all customer data in every region, and you lead one organisation through the next 30 days.
- Pick a regional hospital, a mid-size bank, a city council or a SaaS startup, then choose what you had in place before (backups, break-glass identity, paper procedures and more) on a limited budget.
- Fourteen decisions from Hour 1 to Day 30 move five meters: Operations, Trust, Cash, Data recovered and Team stamina. A fictional news ticker escalates as the days pass.
- You finish with a grade and a debrief that maps each weak call to a concrete control and a PlayCISO tool to put it in place.
- Fiction, clearly labelled: a total, permanent loss of all customer data at a hyperscale provider has never happened. The decisions and controls are real resilience practice.
- Free to play, signed out too, and it runs in your browser; nothing is sent to us. Downloading the debrief as Markdown or PDF needs a paid plan.
Frequently asked questions
What happens if a cloud provider loses all your data?
Nothing comes back from the provider's side, so recovery depends on what you hold elsewhere: independent backups at a second provider or offline, copies held by partners, paper records and code mirrors. This wargame lets you rehearse that situation with a fictional provider. It has never happened at a hyperscale provider.
Has a hyperscale cloud provider ever lost all customer data?
No. A total, permanent loss of all customer data across all regions of a hyperscale provider has never happened. Cloud incidents are usually service outages, where data is unavailable for a time and then comes back. The scenario is deliberately extreme so that every resilience gap shows.
Was the November 2026 Microsoft 365 outage a data loss?
No data loss has been reported. The outage that began on 12 November 2026 was a service outage affecting Exchange Online, Outlook, Teams and other services, and Microsoft says there is no indication of malicious activity. See our news post for what Microsoft has confirmed.
Why do backups inside the same cloud provider not count as independent?
If the provider fails, a backup stored in the same provider fails with it. A 3-2-1-1-0 approach keeps one copy off-site and one immutable or offline, and proves restores work with a test. In the game, only independent backups or a standby on a second provider bring most of the data back.
What is break-glass access and why does it matter in a cloud outage?
Break-glass accounts are emergency admin accounts kept for when normal sign-in fails. If your single sign-on runs on the provider that failed, you need accounts that do not depend on it, protected with phishing-resistant keys and checked on a schedule, to reach your other systems.
Can I use this wargame for a tabletop exercise?
Yes. Play it as a team with the screen shared, argue each decision, and compare grades across organisation types. The debrief lists the controls behind each decision; downloading it as Markdown or PDF needs a paid plan.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.