A hospital is under ransomware attack. You are the incident-response team. Detect, contain, recover — before patient systems fail.
Meridian Health has gone dark. A ransomware crew is inside the network, and you are on the incident-response team — an original character with a role, a console, and a crisis you did not choose. Detection, hunting, forensics, recovery, command, communications: pick your seat.
Over seventy-two hours you triage alerts, reconstruct the kill-chain, isolate infected segments, face the ransom demand, eradicate the adversary, and restore the hospital. The conflict is detection against evasion — and every decision costs something real.
The single point of command for the response — sets priorities, allocates the team, and owns communication to hospital leadership.
The first line of detection — monitors alerts, triages signal from noise, and raises the alarm that starts the response.
The proactive investigator who hunts the adversary across the environment, surfacing footholds that automated detection missed.
The investigator who reconstructs the attack timeline from evidence, establishing exactly how the adversary got in and how far they reached.
The hands-on engineer who isolates infected segments, rebuilds compromised systems, and restores the hospital from trusted backups.
The team's voice to the outside world — managing breach notification, regulators, the press, and the hard question of the ransom.
The cross-functional team standing up the response — detection, hunting, forensics, recovery engineering, command, and communications. Their charge is to detect, scope, contain, eradicate, and recover from the intrusion while keeping the hospital safe for patients. A clean, verified recovery and a hospital that can be trusted again.
The hospital's executives, clinical leaders, and IT management. They carry responsibility for patient care and the organization's survival, and they want systems back fast — sometimes faster than a sound response allows. Allies of the team, but a source of pressure as well. Continuity of patient care and the survival of the hospital.
The adversary — an organized, financially motivated intrusion crew operating a double-extortion ransomware playbook. Patient, methodical, and businesslike: they encrypt to disrupt and exfiltrate to coerce, and they negotiate like the criminal enterprise they are. Extortion payment through disruption and the threat of disclosure.
The watchers outside the incident — healthcare regulators, law enforcement and cyber authorities, the press, and the patients whose data is at stake. They are owed honest, timely disclosure, and how the team handles them shapes the hospital's standing long after recovery. Accountability, lawful disclosure, and the public interest.
One run through a beat is an attempt — the same word your gradebook uses. Set the length in turns, alone or in groups, and the Activity is waiting when your students arrive.
