🛡️

THE LEAK

Incident response unit • La Fabrik Numérique
🇫🇷 FR

Helios company · board at 10 am

240,000 ACCOUNTS FOR SALE

This morning, Helios's customer database (240,000 accounts) is for sale on a forum. The CISO already has his culprit: Karim, the sysadmin, “logged in at 2 a.m.”. Board meeting at 10 am: he will be fired.

A colleague hands you the investigation: “Before we sacrifice Karim, look at the logs yourself. And mind the timezones.”

Four rooms, one investigation: the timeline, the entry vector, the attribution, then the board. Each proof goes into your case file.

⏱️ 35 min · 💡 3 hints per room · ✦ 4 secrets

The C.I.A. triad

A secret hides here… and three more inside the rooms.

0 / 3