🎯 MISSION ALERT

THE CYBER HEIST Protect the Network

A hacker has breached your organisation's systems. Sensitive data is at risk. Your team has 45 minutes to identify vulnerabilities, neutralise the threat, and recover encrypted files — before it is too late.

▸ MISSION BRIEF // CLASSIFIED

CKC Cares Security Division has detected an intrusion at 03:47 UTC. The attacker, known as PHANTOM_X, has already accessed two secure partitions. Complete three challenges to regain control. The hacker is watching — and talking. Proceed with caution.

3CHALLENGES

45MINUTES

300MAX POINTS

💬CHATBOT

🏆7/10 TO CERTIFY

CHALLENGE 01 / 03

Phishing Email Analysis

PHANTOM_X gained access through a phishing attack. Three rounds of evidence await, each harder to read than the last. Round 1 of 3. Each correct round earns you points.

RECOVERED EMAIL — EVIDENCE FILE #1A

IDENTIFY THE RED FLAGS — TAP ALL THAT APPLY

Not everything below is actually a problem. Only select the ones that are genuinely suspicious.

0 selected

Look very carefully at the sender's email address — the domain after the @ symbol. Real organisations only email from their own official domain. And ask yourself: when would a legitimate IT department ever need your credit card number?

CHALLENGE 02 / 03

Firewall Configuration

PHANTOM_X has scrambled your firewall rules, leaving critical ports exposed. You need to classify all 8 network traffic types as either ALLOW (safe) or BLOCK (dangerous) to restore the firewall and earn points.

1ST TAP

✔ ALLOW

Turns green — safe traffic

2ND TAP

✖ BLOCK

Turns red — dangerous traffic

3RD TAP

↺ CLEAR

Resets — start again

FIREWALL CONTROL PANEL

ALLOW — safe traffic

BLOCK — threat or suspicious

REFERENCE PRINCIPLES: Traffic from known internal systems, company VPNs, or verified admin sources is generally safe. Traffic from external, unfamiliar or first-contact sources, especially with unusual timing, should generally be blocked pending review.

Look at where each connection is coming from, not just the port number. Anything from your own company, a known admin, or your company VPN is safe to allow. Anything from an unfamiliar external source, especially with odd timing or repeated attempts, should be blocked pending review.

CHALLENGE 03 / 03

Data Recovery — Decrypt the Files

PHANTOM_X has encrypted your most sensitive files using a Caesar cipher with a shift of 3. Decode the encrypted message to reveal the recovery password and lock the hacker out for good. Use the reference table below to help you.

ENCRYPTED MESSAGE — VAULT CONTENTS (1 OF 5)

Each letter has been shifted 3 places forward in the alphabet. Use the table below to shift each letter back 3 places to decode it. Spaces stay as spaces.

CAESAR CIPHER REFERENCE TABLE (ENCODED → ORIGINAL)

ENTER YOUR DECODED ANSWER

Decode the message above — type the decoded words with spaces between them:

🛡 MISSION ACCOMPLISHED

Network Secured.

Final score: 0 points | Time remaining: --:-- | Rating: EXCELLENT

▸ WHAT YOU JUST LEARNT — REAL-WORLD SKILLS

LESSON 01

Phishing Awareness
Always verify sender domains, spot urgency tactics, and never share credentials or financial details via email — no matter how official it looks.

LESSON 02

Firewall Principles
Not all network traffic is equal. Knowing which connections to allow and which to block is a core foundation of digital safety.

LESSON 03

Encryption Basics
Ciphers protect data. The Caesar cipher is simple by design — but it shows you how encoding and decoding works, the principle behind all modern encryption.

LESSON 04

Team Response
Cyber incidents demand calm, structured thinking under pressure. You have just practised real incident response in a safe, supported environment.

👥 PLAYED AS A GROUP OR TEAM?

Only one person can take the knowledge check here, on this device. If everyone wants their own certificate, share this link so each person can complete it separately, on their own phone or laptop:

🧠 TEST YOUR KNOWLEDGE

Before your downloadable, shareable certificate unlocks, answer 10 questions based on what you just practised. They cover phishing, firewalls, encryption and safe online habits. Get at least 7 correct to pass. Retry as many times as you like, each restart selects 10 questions from the practice bank.

Practice only: answers are checked on this device. No names, email addresses or results are submitted.

🏆 YOUR CERTIFICATE OF COMPLETION

Enter your name below to generate your personalised certificate. You can download it, print it, or share it on LinkedIn, Facebook, or other social platforms.

CKC CARES GROUP — DIGITAL ESCAPE ROOMS

CERTIFICATE OF COMPLETION

Your Name

has successfully completed

THE CYBER HEIST

Protect the Network — Digital Escape Room

          SCORE: 0 pts
          DATE: 
          RATING: EXCELLENT
        

ckccares.com · engagement@ckccares.com

🤝

LIKED HAVING ALLY AROUND?

Ally also guides a free, 30-minute course for absolutely anyone, from your grandparent to your team lead. No jargon, no pressure, just a friendly starting point for understanding AI.

Meet Ally: AI First Aid (Free) →

READY FOR YOUR NEXT MISSION?

You have completed The Cyber Heist. Four more missions are available in the full CKC Cares Digital Escape Room collection.

🎭

The Deepfake Dilemma

A video of you is spreading online, but you never filmed it. Uncover the fake, navigate the fallout, and protect your identity.

✦ AVAILABLE NOW

📱

Trapped in the Algorithm

You are inside a social media algorithm manipulating everything you see. Identify what is real and what is engineered.

✦ AVAILABLE NOW

⚖️

The AI Ethics Tribunal

You sit on the panel deciding the fate of an AI system accused of causing real harm. Evidence, bias and competing interests collide.

✦ AVAILABLE NOW

💔

Digital Trauma Response

A colleague has been targeted by coordinated online harassment. How does your team respond with empathy, policy and action?

✦ AVAILABLE NOW

Before You Begin