A branching, choose-your-path tabletop built for a retirement plan recordkeeper. Nothing is encrypted and nothing goes down — the data is simply gone. Six shared injects establish the breach, then the room's own decision — disclose now, or confirm scope first — sends the exercise down one of two independent, fully-scripted paths. Neither one buys a clean exit.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any firm that holds sensitive data on behalf of someone else's customers or employees.
A publicly traded recordkeeper and plan administrator headquartered in Charlotte, North Carolina, with an operations and participant service center in Omaha. Tarrow runs 401(k) and 403(b) plans for roughly 2,100 employer plan sponsors covering 3.2 million participants. ~1,400 employees, $480M in annual revenue, and a registered broker-dealer subsidiary that handles rollovers and distributions.
Every week, sponsors send Tarrow payroll census files — names, Social Security numbers, dates of birth, salaries, and bank details for distributions — through a third-party managed file transfer platform. Tarrow's entire business is being trusted with other people's employees' most sensitive data. Which is exactly what an extortion crew is counting on.
Six injects, delivered over the first 41 hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
ParcelSecure, the managed file transfer vendor Tarrow uses to exchange census files with its sponsors, issues an emergency advisory: a critical vulnerability is being actively exploited in the wild. A security analyst checks Tarrow's instance and finds a burst of unusually large outbound downloads over the past nine days.
The CISO confirms roughly 1.1TB moved to an unfamiliar IP range. The platform's logs only go back seven days, so no one can say when the activity started or which sponsors' files were in the window. The instance holds census files for every one of Tarrow's 2,100 sponsors.
An email to the CEO and general counsel from a group calling itself "SilentLedger" attaches 500 real participant records from Crestline Health System and claims 4.1 million records in total. The demand: $8M within seven days, or the full set is published and sold. There's no ransomware and no outage — just the data and the deadline.
The Omaha service center flags a spike in participant address changes followed by distribution requests — 37 in four hours, all routed to newly added bank accounts. Freezing every change and distribution would stop the fraud. It would also stop thousands of legitimate retirees from getting paid.
Counsel lays out the obligations: sponsor service agreements require notice within 72 hours of any incident "reasonably likely to affect" participant data; the broker-dealer has its own customer notification duties; and as a public company, Tarrow owes the market a disclosure within four business days of deciding the incident is material. Then Crestline's CISO calls. She heard about ParcelSecure from a peer and wants to know if Tarrow is affected.
Forensics estimates two to three weeks to establish exactly which sponsors and participants were affected. The disclosure committee is split: one side wants to file publicly and notify all 2,100 sponsors as potentially affected today; the other wants to notify only the sponsors already confirmed and hold the public disclosure until the scope is known. A trade reporter has emailed asking whether Tarrow is on the ParcelSecure victim list. The committee has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
Tarrow files its public disclosure after market close and sends notices to all 2,100 sponsors describing them as "potentially affected." The drafting took six hours, most of it spent arguing over which sentences were fact and which were still under investigation.
Sponsor HR teams forward the notice to their employees overnight. The Omaha service center, staffed for about 6,000 calls a day, receives 41,000 by mid-afternoon. Hold times pass three hours, and screenshots of busy signals start circulating online.
Tarrow's stock opens down 22%. Two analysts downgrade, and a short-seller publishes a note arguing the disclosure means the true scope is worse than stated. Investor relations has no approved language beyond the filing itself.
Forensics narrows the scope: only 640 of the 2,100 sponsors' files were taken. But the stolen files also included bank account details for participants receiving distributions — something the original disclosure never mentioned. The public record is now wrong in both directions.
Pellham Foods, now confirmed as not affected, demands written confirmation and fee credits for the employee panic it absorbed. Vantor Aerospace, confirmed as affected, needs a named list of its exposed employees within 24 hours for its own security reporting obligations.
Participants report calls and emails from "Tarrow Breach Support" offering to "verify and secure" their accounts — asking for login credentials and SSNs. The public disclosure has become the perfect phishing lure, and some of the callers are using real participant data.
Two state attorneys general open inquiries, each citing the gap between the original and amended disclosures. Three class actions are filed, all quoting the Day 2 language. Outside counsel issues a litigation hold that reaches the incident channel the team has been using all week.
General counsel wants to pause all participant-level communications until the litigation strategy is set. The heads of communications and client service argue that going quiet now, after leading with transparency, will look like retreat. The CEO is asked to choose.
Crestline Health System — 14% of revenue — gives formal notice: it will terminate unless Tarrow funds two years of credit monitoring and identity restoration for all 38,000 of its participants and pays for an independent security assessment of its choosing. Other sponsors are watching to see what Crestline gets. The board has to decide.
Forensics finds credentials for Tarrow's sponsor portal inside the stolen files. Every sponsor login must be force-reset, and the portal taken offline to do it — during the week sponsors upload payroll contributions.
Tarrow notifies only the three sponsors whose data is already confirmed in the attacker's sample, including Crestline, under confidentiality requests. The disclosure committee records that materiality is "not yet determined." The reporter gets a one-line holding statement.
Tarrow appears on SilentLedger's leak site with a countdown and a sample naming Crestline and Marlow County Schools. By 9 a.m., the trade reporter publishes — and the story says Tarrow "declined to confirm" an incident it had known about for three days.
Hundreds of sponsors call in after reading the article. Two send letters from their own counsel arguing that "reasonably likely to affect" triggered the 72-hour notice clause for every sponsor on Day 0 — not just the three Tarrow chose to tell.
Account takeovers keep coming because participants were never told to watch their accounts. $3.1M in fraudulent distributions has now been paid out to attacker-controlled bank accounts, most of it before targeted holds went into place.
Forensics confirms the scope: 640 sponsors and roughly 1.9 million participants, including bank account details for anyone receiving distributions. Tarrow now has to notify all of them, fast — and the notification vendor's earliest mail date is eight days out.
Tarrow files its public disclosure. The stock falls 31% the next morning, and the coverage frames the gap since Day 0 as concealment. Within days, a letter from regulators asks for a timeline of when the company determined the incident was material, and why.
Marlow County Schools is required to discuss the breach at a public school board meeting. The teachers' association requests every communication between the district and Tarrow under the state's open-records law. The district asks Tarrow what it can say on the record.
An anonymous post on an industry forum claims Tarrow's security team flagged a ParcelSecure update three weeks before the breach, but it was held behind a quarter-end change freeze. Internal tickets confirm the post is accurate. A reporter asks for comment.
Fraud losses have reached $4.4M across 610 participants, and the number is still rising. One option is to announce today that Tarrow will restore every participant's account in full, before liability is established. The other is case-by-case review, which protects the balance sheet but leaves retirees waiting weeks. The board has to decide.
The account-change freeze put in place on Day 4 is still running. It has stopped the fraud. It has also delayed monthly payments to 11,000 legitimate retirees, some of whom are now calling their congressional offices. Lifting the freeze safely requires a re-verification process that doesn't exist yet.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Tarrow scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Tarrow exercise is a sample — built to show how a data breach simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your data, your contracts, and your notification obligations.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio