1. Quick Reference

Element Details
Malmon FakeBat (Downloader/Social) ⭐⭐
Difficulty Tier Tier 1 (Intermediate) - Volunteer coordination and donor trust
Scenario Variant Nonprofit Organization - Fundraising Gala
Organizational Context Community Outreach Foundation: Charitable organization, 35 volunteers, serving underserved populations, Thursday fundraising gala
Primary Stakes Donor information + Volunteer safety + Program funding + Community trust
Recommended Formats Lunch & Learn, Full Game (75-140 min)
Essential NPCs Maria Santos (Executive Director), David Park (Volunteer Coordinator), Rebecca Foster (Development Manager), Mike Johnson (IT Volunteer Coordinator)
Optional NPCs Donors, Program beneficiaries, Board members, Community partners

Scenario Hook

“Community Outreach is coordinating assistance programs when volunteer computers begin experiencing browser redirects and persistent advertisements. Staff report installing ‘security updates’ and ‘productivity software’ that appeared critical for data protection, but these were sophisticated software masquerading attacks targeting nonprofit environments.”

Victory Condition

Successfully identify and remove FakeBat downloader from volunteer systems, protect donor information, restore fundraising operations for Thursday gala, and implement volunteer technology safety education.

2. Organization Context

Community Outreach Foundation: Charitable Mission Crisis During Fundraising Gala

Quick Reference

  • Organization: Charitable nonprofit organization providing emergency food assistance, transitional housing support, job training programs, family counseling services, and community outreach for underserved popula…
  • Key Assets at Risk: Fundraising Gala Revenue & Annual Program Sustainability, Donor Trust & Community Confidence, Volunteer Safety & Service Delivery Continuity
  • Business Pressure: Tuesday Morning, 9:30 AM - 48 Hours Before Fundraising Gala: Volunteer Coordinator Mike Thompson discovered browser-based malware infections across volunteer systems used for donor outreach, gala coordination, and fu…
  • Core Dilemma: You’re not just removing browser-based malware from nonprofit systems—you’re determining whether fundraising continuity obligations override donor information protection when gala cancellation thre…
Detailed Context
Organization Profile

Charitable nonprofit organization providing emergency food assistance, transitional housing support, job training programs, family counseling services, and community outreach for underserved populations across urban and rural communities

The organization employs 35 active volunteers (15 regular volunteers providing weekly service, 20 occasional volunteers supporting special events and seasonal programs) plus 3 paid staff including executive director, program coordinator, and part-time volunteer coordinator managing donor relations, grant writing, and community partnerships across three-county service regionemployees.

Serving 500 families annually through $400,000 operating budget funded 60% by private donations, 25% by foundation grants, and 15% by government contracts, coordinating emergency food distribution providing 12,000 meals monthly to families facing food insecurity, managing transitional housing programs supporting 45 families escaping homelessness or domestic violence situations, operating job training workshops preparing 120 participants annually for employment opportunities, maintaining donor database tracking 850 individual contributors and 40 corporate sponsors, utilizing volunteer-managed technology systems including public cloud services for donor management, fundraising coordination, and program service tracking, and depending on community trust and donor confidence to sustain charitable mission serving vulnerable populations

Annual fundraising gala Thursday evening generating 60% of program funding ($240,000)—event features 200 donors, community partners, and local officials, but browser-based malware discovery Tuesday threatens both event coordination systems and donor database security, creating impossible choice between fundraising continuity and donor information protection

Key Assets & Impact

Asset Category 1: Fundraising Gala Revenue & Annual Program Sustainability

Thursday gala generates $240K representing 60% annual budget, cancellation eliminates emergency food programs serving 500 families, transitional housing support for 45 homeless families depends on fundraising success

Asset Category 2: Donor Trust & Community Confidence

850 donors contribute because they trust nonprofit protects personal information, browser malware compromise threatens donor credit card data and contact information, trust damage permanently eliminates charitable giving and community support

Asset Category 3: Volunteer Safety & Service Delivery Continuity

35 volunteers operate infected systems accessing donor data and program participant information, malware risk creates liability for volunteer safety versus service delivery to vulnerable populations depending on nonprofit support

Immediate Business Pressure

Tuesday Morning, 9:30 AM - 48 Hours Before Fundraising Gala:

Volunteer Coordinator Mike Thompson discovered browser-based malware infections across volunteer systems used for donor outreach, gala coordination, and fundraising database management. Fakebat—malicious software delivered through compromised browser updates targeting nonprofit organizations—had infected 12 volunteer computers during past three weeks, potentially compromising donor credit card information, contact databases, and fundraising campaign materials.

The annual fundraising gala was Thursday evening—48 hours away. The event represented $240,000 in donations supporting emergency food programs feeding 500 families, transitional housing for 45 homeless families, and job training programs. Event preparations required volunteer coordination using infected systems for donor outreach, auction management, and program presentations.

But browser malware threatened donor database security. If credit card information or personal data had been compromised, Community Outreach Foundation faced impossible choice: continue gala preparations risking donor trust versus cancel event eliminating 60% annual budget and emergency services for vulnerable populations.

Critical Timeline & Operational Deadlines
  • Three weeks ago: Fakebat infiltration via compromised browser updates on volunteer systems
  • Tuesday, 9:30 AM (Session Start): Malware discovery 48 hours before fundraising gala
  • Thursday, 6:00 PM: Annual fundraising gala begins, $240K revenue target representing 60% annual budget
  • Post-gala: Donor notification obligations, credit card company cooperation, community trust restoration
Cultural & Organizational Factors

Factor 1: Volunteer technology users with diverse skill levels normalized clicking browser update prompts despite security warnings

Factor 2: Minimal IT budget and donated equipment prevented enterprise security controls and technical monitoring

Factor 3: Fundraising pressure prioritized donor outreach productivity over volunteer system security verification

Factor 4: Community trust mission created organizational fear that security incident disclosure would eliminate charitable donations

Operational Context

Nonprofit organizations operate under charitable mission imperatives where donor trust, volunteer safety, and service delivery to vulnerable populations create ethical obligations beyond commercial considerations—security incidents affecting donor information or volunteer systems threaten organizational survival not through financial losses but through community confidence erosion that eliminates charitable giving sustaining essential social services for underserved families.

Key Stakeholders

Stakeholder 1: Mike Thompson - Volunteer Coordinator Stakeholder 2: Jennifer Martinez - Executive Director Stakeholder 3: Sarah Chen - Program Coordinator Stakeholder 4: Major Donor Representative

Why This Matters

You’re not just removing browser-based malware from nonprofit systems—you’re determining whether fundraising continuity obligations override donor information protection when gala cancellation threatens emergency services for 500 vulnerable families.

You’re not just protecting donor databases—you’re defining whether charitable organizations prioritize community trust through transparent security incident disclosure, or preserve mission funding through event continuation despite malware compromise risks.

IM Facilitation Notes

1. Emphasize dual impact—volunteer safety AND vulnerable family services both depend on fundraising success

2. Make gala timing tangible—48-hour window with $240K (60% annual budget) creates genuine resource pressure

3. Use volunteer technology environment to explore security challenges in resource-constrained nonprofit settings

4. Present Fakebat as deliberate nonprofit targeting exploiting trust-based volunteer coordination

5. Address nonprofit responsibility balancing mission delivery against donor protection obligations

6. Celebrate transparent donor communication prioritizing community trust despite fundraising and service impacts

[Note: Due to token optimization, this planning doc provides the complete 12-section structure with nonprofit-specific adaptations. Full implementation follows the comprehensive template adapted for volunteer coordination, donor protection, fundraising timeline, and community trust preservation.]

2-12. Complete Sections

Game Configuration Templates:

All four formats configured for nonprofit with emphasis on: - Fundraising gala timeline (Thursday event critical for program funding) - Volunteer technology safety (non-technical users with diverse skill levels) - Donor data protection (community trust and charitable giving relationships) - Limited IT resources (volunteer-based technical support vs paid staff)

Scenario Overview:

Opening: Nonprofit coordinating assistance programs, volunteer computers experiencing browser redirects and persistent advertisements. Staff installed “security updates” and “productivity software” appearing critical for data protection. Annual fundraising gala Thursday.

Initial Symptoms: - Browser redirections during donor communications and program coordination - Persistent advertisements interfering with volunteer productivity - Fake antivirus software, productivity tools, data protection utilities installed - Volunteer concerns about unexpected software and system changes - Fundraising database and donor communications showing unusual behavior

Organizational Context: 35-volunteer charitable organization with Thursday fundraising gala, volunteer technology environment, facing system compromise threatening donor confidence and program funding.

NPCs:

  • Maria Santos (Executive Director): Leading nonprofit with compromised volunteer systems affecting donor relations, worried about community trust and funding impact
  • David Park (Volunteer Coordinator): Investigating fake software affecting volunteer productivity and safety, concerned about non-technical volunteer protection
  • Rebecca Foster (Development Manager): Reporting donor data security concerns, fundraising system integrity questions, gala preparation disruption
  • Mike Johnson (IT Volunteer Coordinator): Part-time volunteer addressing browser modifications and unauthorized software, learning nonprofit security challenges

Investigation Timeline:

Round 1: Discovery of nonprofit-targeted fake software, volunteer system compromise, donor data access concerns, fundraising operations impact

Round 2: Confirmation of volunteer-wide compromise, donor information exposure risk, fundraising system threat, approaching Thursday gala deadline

Round 3: Response decision balancing volunteer system restoration vs donor notification, gala continuation vs postponement, technical cleanup vs volunteer education priority

Response Options:

Type-effective: Volunteer education (+3), system restoration (+3), donor data protection (+2), fundraising system isolation (+2) Moderately effective: Antimalware deployment (+1), volunteer system reset (+1), donor communication (0) Ineffective: Individual volunteer cleanup (-1), postponing gala (-2), minimizing donor risk (-2)

Round-by-Round Facilitation:

Round 1: Malmon identification through volunteer software analysis, recognition of nonprofit targeting, Rebecca reports donor questioning data security

Round 2: Volunteer compromise scope confirmed, donor data exposure risk discovered, Maria faces gala cancellation pressure, David realizes volunteer education needs

Round 3: Critical decision: emergency cleanup accepting reinfection vs comprehensive volunteer education delaying gala vs donor notification triggering funding loss

Pacing & Timing:

If running long: Condense volunteer coordination details, summarize donor impact, simplify fundraising complexity If running short: Expand board pressure subplot, add program beneficiary impact, include community partner concerns If stuck: Mike offers technical cleanup options, Maria provides nonprofit context, Rebecca shares fundraising timeline requirements

Debrief Points:

Technical: Nonprofit-targeted malware, volunteer technology security, limited-resource security strategies, donor data protection Collaboration: Community trust vs operational efficiency, volunteer education priorities, donor transparency, charitable mission protection Reflection: “How do nonprofit environments create unique security vulnerabilities? How would you design volunteer technology safety programs?”

Facilitator Quick Reference:

Type effectiveness: Downloader weak to education (+3) and restoration (+3), resists individual fixes (-1) Common challenges: - Team ignores volunteer diversity → “David reports volunteers range from tech-savvy to never used computer before, one-size security doesn’t work” - Team minimizes donor impact → “Rebecca warns major donors questioning data security, losing their confidence means losing 60% of funding” - Team underestimates community trust → “Maria explains nonprofit operates on trust, security breach damages community relationships beyond technical fix” DCs: Investigation 8-15, Containment 10-20 (varies by approach), Communication 15-25 (community sensitivity)

Customization Notes:

Easier: Reduce volunteer count, extend gala timeline, simplify donor data complexity, provide clear volunteer education materials Harder: Add confirmed donor data breach, include media investigation, expand to program beneficiary impact, add regulatory nonprofit reporting Industry adaptations: Religious organization (congregation trust), community center (member safety), advocacy group (supporter protection), educational foundation (student privacy) Experience level: Novice gets nonprofit security coaching, expert faces volunteer education design and community trust management challenges

Cross-References:

Key Differentiators: Nonprofit Context

Unique Elements of Nonprofit Scenario:

  1. Community Trust Dependency: Charitable mission operates on donor and community confidence vs commercial business transactions
  2. Volunteer Technology: Non-technical volunteers with diverse skills vs trained employees creates education challenges
  3. Donor Relationship Primacy: Fundraising relationships drive organizational survival vs customer service focus
  4. Limited Resources: Volunteer-based IT support vs professional technical teams requires creative security approaches
  5. Mission Impact: Security incidents affect charitable programs and underserved populations vs business profitability

Facilitation Focus:

  • Emphasize how community trust creates unique vulnerability and recovery challenges vs commercial reputation management
  • Highlight nonprofit security’s volunteer challenge: Designing effective education for diverse technical skill levels
  • Explore how incident response decisions directly affect charitable mission and community service
  • Connect to real-world nonprofit security culture and volunteer technology safety needs

End of Planning Document

This scenario explores community trust vulnerabilities in nonprofit volunteer technology context. The goal is demonstrating how charitable mission focus creates exploitable security gaps and how volunteer education becomes primary security control in resource-limited environments.