Free scenario
Backups worked. The data still left.
A ransomware tabletop you run yourself, with your own leadership team. The brief and all four injects are on this page. The printable pack adds the notes for whoever runs it, and your email is optional.
What it is
A 3-hour ransomware exercise for 6 to 12 people, run by somebody inside your company with no preparation beyond reading it once. It is a discussion exercise. Nothing is switched off and no live system is touched.
The backups are fine and the restore works, and the incident is not over, because the attacker claims to have copied the data out first. In Coalition's 2025 claims data, 70 percent of ransomware claims involved data theft as well as encryption (Coalition, 2026 Cyber Claims Report, 2026). A clean restore ends the outage, not the incident. Rooms that have only ever rehearsed the outage stop at the wrong place.
Every detail is fiction. Swap the servers, the hours and the gigabyte figure for yours.
The short version
Read the brief aloud about fifteen minutes in. Nobody sees it beforehand. Then give the room one inject at a time, at the elapsed times shown. One rule: no solving. Keep asking who decides and by when. Leave the last half hour for a debrief.
The brief read aloud at 0:15
It is 07:10 on a Tuesday. Your operations lead is first in and cannot open the shared drive. Neither can the two people who arrive after her. Every file name on the drive now ends in an extension nobody recognizes, and there is a text file sitting in every folder.
The text file says your files are encrypted, that 400 gigabytes were copied out over eleven days, and that a decryption key and a promise not to publish are both for sale. Seventy-two hours. The contact address is on a site you reach through a browser nobody here has installed.
Your IT provider is on the phone by 07:40. The file server and two of three application servers are encrypted. Sunday night’s backup ran and appears intact. The account used belongs to somebody in finance who is on holiday, and it signed in from outside Canada at 23:14 on Friday.
Nothing has been touched. Email works, phones work, and your first client call is at nine.
Stop there. Questions only, no solutions. Then start the clock.
-
Inject 1 at 0:25
A guess becomes a fact in six minutes.
08:15. Your provider sends one line: looks like it came in through a VPN account, we are still checking. Somebody forwards it to the leadership group with the words “so it was VPN.” Six minutes later the client team replies on the thread asking whether to tell the nine o’clock client.
The decision it forces. Who is running this, what they need first, and where a fact must be written down before anyone acts on it.
-
Inject 2 at 0:55
Four days down, or stay up and carry it.
09:20. Your provider recommends taking everything down, including the systems still working, and rebuilding from Sunday’s backup. Four working days, and Monday’s work is lost. Staying up while they investigate is the alternative, and they will not sign that off as safe. Four days means two missed client deadlines and a payroll cut-off.
The decision it forces. Down or up, who authorizes it, on what basis, and who tells the clients.
-
Inject 3 at 1:40
Somebody outside has a screenshot.
13:00. A journalist emails your general enquiries address. A group has posted your company name on a leak site with a countdown and a directory listing, and she attaches a screenshot. Three folder names are client names. She wants comment by 17:00. Twenty minutes later your largest client’s security lead asks, directly, whether their data is in it.
The decision it forces. Who speaks, who approves the words, what you will say before you know, and what you tell the client who asked outright.
-
Inject 4 at 2:10
Nothing was published. Nothing was disproved either.
Thursday, 16:00. Systems are back, the restore was clean, the attacker is out. Nothing appeared on the leak site and the countdown has expired. The provider’s written summary says there is no evidence data left the environment, and no evidence it did not. Your finance lead asks whether you still have to tell anybody.
The decision it forces. What “over” means, who signs it off, and what you owe people whose data may have been in it when the evidence is absent rather than clear.
What the printable pack adds
Six pages, set for print, free to copy and adapt inside your own organization. Everything on this page, plus the parts written for whoever runs the session:
- Notes on every inject: what to push the room on, and what a good answer sounds like.
- A facts sheet for the first inject, held back from the room.
- A reserve inject for a room that moves fast, and when not to use it.
- A capture sheet for the scribe, so decisions and times are written down as they happen.
- Five ways this goes wrong when you run it yourself, and the fix for each.
Keep those pages with whoever runs it. They tell the facilitator what the room is meant to find out for itself.
When to use it, and when it is the wrong thing to reach for
Use it between whatever formal exercise you run once a year. Quarterly is a reasonable rhythm, and repetition is what makes decisions fast under pressure. It is also a sensible thing to run before a facilitated session, so you walk into that one already knowing your two worst gaps.
It is the wrong thing to reach for if the money has gone out of the door rather than the systems going down. A payment fraud has nobody to negotiate with and the only clock that matters belongs to a bank. The business email compromise pack is the one for that. If the breach is at a supplier and you hold none of the facts, use the third-party breach pack.
It does not produce third-party attestation, and page one of the pack says so. Run this and you will find real gaps, and the write-up is yours to keep. What you cannot write is the page saying an independent facilitator was in the room. Your own account of your own exercise answers the question on a renewal application. It does not evidence it.