Westhaven Community Services · Recovery desk · 07:12–15:26 UTC · Five independent response drills
You are on duty when ordinary systems stop being trustworthy. Protect the next hour, test what can be recovered and give every return to service a defensible boundary.
Five free ransomware-response missions. Contain the damage, question the backup and earn a safer way back.
Join the fictional Westhaven recovery desk for five complete ransomware and destructive-attack drills: a changing file share, a destructive app identity, a misleading backup dashboard, an extortion claim and a staged service-return decision. Three levels build from containment to trustworthy recovery. Every mission is free and open in any order; no prerequisite locks, payment, external tools or live destructive actions. Guest practice is temporary; sign in before starting to retain advancement and earned badges. Approximately 88 minutes, with no countdown. All operational evidence is synthetic and informed by dated primary sources. This is guided practice, not professional certification.
A depot colleague reports renamed files and a ransom note on the shared drive. Some users are still connected, and the desk manager wants to reboot the server. Establish a safe containment boundary, preserve central evidence and keep dispatch working through its approved fallback.
Storage and database jobs are failing. Central audit points to an application identity with no interactive user, and a job owner suggests resetting the team password. Trace the destructive operations, choose an authorised permission boundary and verify what the response actually changes.
Two backups could recover the records catalogue: a recent online copy and an older protected copy. Both show green completion. Their isolation, trust history and business gaps differ. Choose a controlled test route, inspect the returned results and propose a recovery point the owners can actually defend.
A message threatens publication of every community-service record before a deadline. It includes two recognisable samples, while the technical team has only partial transfer evidence. Handle the material safely, test what each source supports and prepare an owned impact/communication plan without negotiating or inventing certainty.
The records catalogue opens in the recovery room, but identity, data freshness and write permissions still matter. The service owner can request a read-only canary or prioritise staff reconciliation while public writes remain closed. Choose a route, inspect its distinct result and hand over an honest reopening recommendation.