The Inquisitor: Compliance Breach
The Inquisitor: Compliance Breach
Planning Resources
Scenario Details for IMs
Hook
“It’s Thursday morning at Chimera Interactive. Your privacy team looks exhausted. Over the past 72 hours, you’ve received over 200 Data Subject Access Requests – that’s more than you normally get in a year. Legal is demanding faster responses. The 30-day GDPR clock is ticking. But something feels wrong. Some of these requests are… strange. Jamie Chen from your privacy team just pulled you aside: ‘I think we might have a problem. A big one.’ What do you do?”
Initial Symptoms to Present:
Escalation Timeline:
- Hour 1: Privacy team realizes bounced email = sent PII to invalid address
- Hour 2: Pattern analysis reveals coordinated request campaign
- Hour 3: Security discovers ongoing exfiltration (started 48 hours before DSAR spike was noticed)
- Hour 4: Executive notification required – scope unknown, breach notification decision pending
Key Discovery Paths:
Round 1: Pattern Recognition (20 minutes)
Round 2: Investigation (25 minutes)
Round 3: Response (20 minutes)
Response Options:
- Option A: Immediate Containment – Block exfiltration IP (185.234.72.19), isolate affected systems. Super effective – stops ongoing data loss. Trade-off: may tip off attacker to rotate infrastructure.
- Option B: DSAR Triage – Pause all DSAR responses pending verification review. Moderately effective – prevents further data disclosure. Trade-off: regulatory exposure from missed deadline.
- Option C: Notification Strategy – File 72-hour breach notification to relevant supervisory authority. Required if personal data breach confirmed. Trade-off: scope unknown, notification may be incomplete.
The Inquisitor’s WEAKNESS is Cross-Functional Coordination (-3). Reward players who establish a unified incident command spanning security and compliance.
Evolution Triggers:
- If DSARs distract defenders for 48+ hours without security involvement → Coordinated Exfiltration activates
- If verification shortcuts continue → additional PII exported to attacker-controlled addresses
- If security and compliance share intelligence early → attack surface collapses; The Inquisitor’s evasion drops to near zero
Session Formats
Quick Demo (35–40 min)
- Focus: The moment of realization – bounced email reveals PII sent to attacker
- Guided Investigation: Provide DSAR #178 (bounced) and 2 suspicious samples; skip the full pattern analysis
- Pre-defined Response: Pause DSARs + loop in security + assess breach notification obligation
- Learning: Legitimate processes can be weaponized; deadline pressure degrades judgment
Lunch & Learn (75–90 min)
- Focus: Full three-phase arc – discovery, investigation, response
- Guided Investigation: Use all five DSAR samples; reveal security alert log in Round 2
- Round structure: Round 1 (20 min Discovery) → Round 2 (25 min Investigation) → Round 3 (20 min Response) → Debrief (15 min)
- Learning: Cross-functional coordination as the key defensive capability; privacy compliance as attack surface
Full Game (120–140 min)
- Focus: Open investigation with no pre-provided clues; teams determine what to examine
- Open Investigation: Full DSAR analysis, security log review, infrastructure mapping
- Creative Response: Teams develop breach containment, notification strategy, and process reform
- Learning: Deep dive on GDPR/CCPA obligations under breach conditions, organizational silo failure modes
Advanced Challenge (150–170 min)
- Focus: High-pressure, ambiguous scenario
- Complexity: Remove access to security logs until Round 3; add conflicting legal advice; executive pressure to continue DSAR processing; ambiguity about whether the breach notification clock has started
- Ethical Dilemmas: Pause DSARs (regulatory exposure) vs. continue (send more PII to attackers)? Notify now with incomplete scope vs. delay to gather more information?
Lunch & Learn Materials (75-90 min, 3 rounds)
Round 1: Discovery (20 min)
Investigation Clues:
- Clue 1 (Minute 5): “Comparing DSAR requests, you notice nearly identical phrasing across dozens of submissions. Same template, different names. Several ask for ‘the specific systems and databases where my data is stored.’”
- Clue 2 (Minute 10): “Identity verification documents have suspiciously small file sizes (150-180 KB) – real ID scans are typically 400+ KB. Metadata shows creation dates within hours of submission.”
- Clue 3 (Minute 15): One DSAR claims to be from ‘Sarah Mitchell, former QA employee 2019-2021.’ How would an external attacker know specific employment details that aren’t public?
Discovery Questions:
- “What patterns do you notice in these DSAR requests?”
- “What would make IT staff skip verification steps during a crunch period?”
- “The GDPR deadline is 30 days. You’re on Day 4. How does that pressure affect your decisions?”
- “Has anyone talked to the security team? Why not?”
Response Guidance:
Teams should begin questioning the legitimacy of the DSAR volume and looking for coordination patterns. If teams stall, have the privacy analyst NPC express concern about the pattern or the junior analyst NPC point out the template similarities.
Round 2: Investigation (25 min)
Investigation Clues:
- Clue 4 (Minute 25): The response to alex.wong.gamer@gmail.com (CCPA request, California) bounced. That response contained full PII, payment data, AND a complete infrastructure map.
- Clue 5 (Minute 30): Security pulls firewall logs. Unusual outbound traffic to IP 185.234.72.19 (Moldova) started 48 hours ago – BEFORE the DSAR spike was noticed. 2+ GB exfiltrated across multiple production systems.
- Clue 6 (Minute 35): Cross-referencing: the systems mentioned in DSAR responses (accounts-prod-west, analytics-prod, payment-api-v2) exactly match the exfiltration sources. The DSARs MAPPED the targets.
Investigation Questions:
- “What does the bounced email tell you about the nature of this threat?”
- “If you were the attacker, why would you ask about ‘systems and databases’ in a DSAR?”
- “The exfiltration started BEFORE the DSAR spike was noticed. What does that suggest about the attack timeline?”
- “Who owns this incident – privacy team or security team?”
Response Options:
- Option A: Immediate Containment – Block exfiltration IP (185.234.72.19), isolate affected systems.
- Pros: Stops ongoing data loss immediately; decisive action demonstrates security leadership.
- Cons: Business disruption; may tip off attacker to rotate infrastructure.
- Type Effectiveness: Super effective – stops ongoing data loss.
- Option B: DSAR Triage – Pause all DSAR responses pending verification review.
- Pros: Prevents further data disclosure via DSARs; allows systematic review of fulfilled requests.
- Cons: Regulatory exposure from missed GDPR/CCPA deadline; legitimate data subjects delayed.
- Type Effectiveness: Moderately effective – prevents further data disclosure.
- Option C: Notification Strategy – File 72-hour breach notification to relevant supervisory authority.
- Pros: Fulfills regulatory obligation; demonstrates responsible governance; gets regulators aligned early.
- Cons: Scope unknown – notification may be premature or incomplete; potential PR fallout.
- Type Effectiveness: Required if personal data breach confirmed – which it is.
Round 3: Response (20 min)
Regulatory Pressure: GDPR Art. 33 requires breach notification to the supervisory authority within 72 hours of becoming aware of a personal data breach. CCPA requires notification to the California AG. You’re now aware.
Response Questions:
- “You have 180 pending DSARs. Maybe 20% are legitimate. How do you tell the difference?”
- “Is sending PII to attackers via DSAR response a notifiable breach? Why or why not?”
- “What would you tell the supervisory authority about how this happened?”
- “What process changes would prevent this in the future?”
If Players Get Stuck:
- “What would you do with unlimited resources and no deadline pressure?”
- “If you KNEW these were fake requests, what would stop you from treating them that way?”
- NPC Jamie Chen bursts in: “I found something else…” (reveal next clue)
- NPC Morgan Torres: “Legal just called. They want a status update in 15 minutes.” (add pressure)
Round Transition Narratives
After Round 1 → Round 2:
The team’s initial pattern analysis has revealed the coordinated nature of the DSAR campaign. Now the bounced email discovery shifts the scenario from “suspicious compliance burden” to “active attack.” The privacy team must decide whether to loop in security – and how to handle the 200+ pending requests while investigating.
After Round 2 → Round 3:
The investigation has confirmed this is a coordinated attack: fraudulent DSARs for reconnaissance and cover, secondary payload for exfiltration. The team now faces the hardest decisions: breach notification obligations, DSAR processing pause, and coordinating a unified response across security and compliance functions.
Debrief Focus (10 min)
- Cross-functional coordination as the decisive defensive capability
- How deadline pressure degraded verification standards
- Privacy compliance obligations as an exploitable attack surface
- The organizational silo between security and compliance teams
- What process changes would prevent this attack pattern
Full Game Materials (120-140 min, 3 rounds)
Round 1: Discovery & Pattern Recognition (30-35 min)
“It’s Thursday morning at Chimera Interactive. Your privacy team looks exhausted. Over the past 72 hours, you’ve received over 200 Data Subject Access Requests – that’s more than you normally get in a year. Legal is demanding faster responses. The 30-day GDPR clock is ticking. But something feels wrong. Some of these requests are… strange. Jamie Chen from your privacy team just pulled you aside: ‘I think we might have a problem. A big one.’ What do you do?”
Players investigate openly using their role capabilities. Key discoveries available include the DSAR template patterns, suspicious ID document sizes, the “systems and databases” question in multiple requests, and the former employee knowledge anomaly.
If team stalls: NPC Alex Reyes approaches the team: “I’ve been comparing these requests. A bunch have almost identical phrasing… and the ID documents look weird too. Small file sizes, like they were generated not scanned?”
Facilitation questions:
- “What patterns do you notice in these DSAR requests?”
- “The GDPR deadline is 30 days. You’re on Day 4. How does that pressure affect your decisions?”
- “Has anyone talked to the security team about this volume spike? Why not?”
Round 1→2 Transition
The team’s pattern analysis shifts the situation from “compliance burden” to “potential attack.” The bounced email discovery in Round 2 will confirm suspicions. The privacy team must now decide how to handle the 200+ pending requests while investigating.
Round 2: Investigation & Escalation (35-40 min)
NPC Alex Reyes rushes in: “DSAR #178 – the email bounced. We sent a full data export to… nowhere? Or somewhere? That export had their full name, address, payment info, AND the system architecture stuff they asked for.”
Players investigate the full scope of the breach. Key discoveries available include the exfiltration traffic to Moldova, the correlation between DSAR responses and exfiltration targets, and the secondary payload that started before the DSAR spike.
Facilitation questions:
- “What does the bounced email tell you about the nature of this threat?”
- “If you were the attacker, why would you ask about ‘systems and databases’ in a DSAR?”
- “The exfiltration started BEFORE the DSAR spike was noticed. What does that suggest about the attack timeline?”
- “Who owns this incident – privacy team or security team?”
Round 2→3 Transition
The investigation has confirmed a coordinated attack. The team must now make critical response decisions: contain the exfiltration, pause DSAR processing, notify regulators, and coordinate across organizational silos.
Round 3: Response & Recovery (35-40 min)
Regulatory pressure: GDPR Art. 33 requires breach notification to the supervisory authority within 72 hours of becoming aware of a personal data breach. CCPA requires notification to the California AG. You’re now aware.
Facilitation questions:
- “You have 180 pending DSARs. Maybe 20% are legitimate. How do you tell the difference?”
- “Is sending PII to attackers via DSAR response a notifiable breach? Why or why not?”
- “What would you tell the supervisory authority about how this happened?”
- “What process changes would prevent this in the future?”
Victory conditions:
- Team establishes unified incident command across security and compliance
- Exfiltration IP blocked and affected systems isolated
- DSAR processing paused with a plan to verify legitimate requests
- Breach notification strategy developed with appropriate regulatory bodies
- Organizational process reform initiated to prevent siloed response
Handouts for Players
Print or share these handouts with players during the session. Each opens as a standalone page with print-friendly formatting. IM notes are visible on screen but hidden when printing.
- Handout A: DSAR Request Samples — Five DSAR samples for pattern analysis (1 legitimate, 4 suspicious)
- Handout B: DSAR Response Export — The accidentally sent data export from DSAR #178 (the “smoking gun”)
- Handout C: Security Alert Log — 72 hours of SOC alerts showing escalating exfiltration
- Handout D: Privacy Team Slack Thread — Three days of team communications showing organizational dynamics
Debrief Questions
- Technical: What would have caught this attack earlier?
- Process: How would you change your DSAR verification process after today?
- Organizational: What organizational silo broke first in this scenario? Would that happen at your organization?
- Compliance: The attacker used your compliance obligations against you. How do you defend against that?
- Ethical: Is sending PII to attackers via a DSAR response a notifiable breach? Why or why not?
- Prevention: What long-term controls are most effective against this type of attack?
- Reflection: What was the hardest decision you had to make, and why?
Community Contribution
This scenario was created by Inver (privacy lawyer, TTRPG publisher), based on real attack patterns observed in privacy practice.
Contributor: Inver (privacy lawyer, TTRPG publisher) Contribution Date: 2026-02-10 License: CC-BY-SA-4.0