A branching, choose-your-path tabletop built for a national retailer. Someone has been quietly copying card numbers from the checkout page for five months, and the biggest shopping week of the year starts in four days. Six shared injects establish the breach, then the room's own decision — take checkout offline, or keep selling while forensics works — sends the exercise down one of two independent, fully-scripted paths. Neither one saves the holiday.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any business that takes payments online through a site built from dozens of third-party components.
A Denver-based outdoor and apparel retailer with 310 stores, ~14,000 employees, and $3.6B in annual revenue. E-commerce makes up 42% of sales, and the five days from Black Friday through Cyber Monday account for nearly a fifth of the year's online revenue.
Larkin's checkout page is its own, but the code running on it isn't all Larkin's. Like most retail sites, it loads dozens of third-party scripts — analytics, personalization, reviews, chat. Any one of them can see what a customer types. Nobody at Larkin owns the full list.
Six injects, delivered over the first 47 hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
Larkin's acquiring bank calls: card networks have flagged Larkin as a likely "common point of purchase" for a cluster of fraudulent transactions. The bank wants a response by end of day.
Security finds unfamiliar code on the checkout page, loaded through a compromised script from Larkin's analytics vendor. It has been sending card numbers to a lookalike domain since June. Up to 900,000 cards may be affected.
Black Friday is four days away. The merchandising team projects $210M in online sales over the five-day holiday weekend, and inventory has been bought to match.
The acquiring bank tells Larkin it must engage an approved forensic investigator, and that card network fines and assessments are likely. The size will depend in part on how long the exposure continues.
Brightpath Analytics denies it was breached and says customers are responsible for the scripts they place on their own sites. It declines to share its logs without a subpoena.
Security can remove the malicious script within the hour. But forensics can't confirm the site is clean for three to five days. The room has two options: take online checkout offline until a clean rebuild is verified — losing most of Black Friday — or remove the script, add monitoring, and keep selling while forensics works. The room has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
Larkin takes online checkout offline and posts a maintenance message. Within hours, customers and tech bloggers speculate about a breach. Larkin's social media team has no approved response.
Shoppers redirect to stores. Online-only inventory sits in distribution centers, store staffing was planned for a normal week, and in-store pickup orders are stuck in a system that's also offline.
A reporter calls asking whether the outage is a breach. Counsel advises that Larkin should confirm it rather than issue a misleading denial — days before notification letters are ready.
Online sales on Black Friday are down about $140M from plan. The CFO recommends lowering quarterly guidance, and the CEO has an investor conference next week.
Forensics finds a second piece of skimming code inside the mobile app's embedded checkout. It would have kept collecting card numbers if Larkin had simply removed the first script and kept selling.
Forensics confirms about 870,000 cards were exposed. Notification emails start going out, and customers' email providers flag many of them as phishing.
The card networks signal that fines and fraud assessments could reach about $11M. The acquiring bank wants a remediation plan within 30 days.
Engineering has rebuilt checkout with far fewer third-party scripts. Forensics has validated most of it, but not all. Relaunching now captures Cyber Monday; waiting three more days means full validation. The room has to decide.
Counsel reviews the Brightpath contract: it has no security requirements, no right to audit, and a liability cap equal to three months of fees. Larkin has 41 similar script vendors.
The post-incident review finds that marketing, e-commerce, and security each assumed someone else was approving the scripts on the checkout page. Nobody was.
The malicious script is removed, and security adds monitoring for unexpected changes on checkout. Sales continue normally. The decision rationale is captured in a single email thread.
Forensics finds a second skimmer, hidden inside the mobile app's embedded checkout. It has been active the whole time — about 30 more hours of peak-season traffic, and roughly 60,000 more cards.
The acquiring bank escalates: continued exposure after Larkin knew of the breach will likely increase card network assessments. The bank asks Larkin to confirm in writing when the exposure ended.
Black Friday online sales beat last year's. At the same time, the fraud team sees rising chargebacks and card-not-present fraud linked to Larkin cards.
An independent security researcher publishes a teardown of the skimmer found on Larkin's mobile checkout. Tech media pick it up within the hour, before Larkin has said anything publicly.
Larkin confirms the breach. The coverage focuses on one fact: Larkin knew about the skimming before Black Friday and kept selling.
Several state attorneys general send letters asking when Larkin learned of the breach, why it kept online sales open, and how many customers were affected after that date.
Store associates report being confronted by angry customers about the breach. They have no talking points, and some have posted their frustration on social media.
Card fraud is generally reimbursed by issuing banks, so customers may not lose money directly. The room must decide whether to offer all affected customers identity monitoring and a goodwill credit — about $9M — or provide only what's required. The room has to decide.
The board asks to see the decision record from Day 2. It's a single email thread with no risk assessment attached. The board asks who made the call and on what basis.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Larkin scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Larkin exercise is a sample — built to show how a retail data breach simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your customers, your payment flows, and your peak season.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio