Incident library

A glossy QR poster appeared beside reception overnight, promising faster visitor Wi-Fi without IT approval.

A delivery text says payroll's missing parcel will be returned unless someone pays a tiny fee now.

Payroll asks everyone to confirm bank details before noon, but the link smells wrong.

Your meeting starts in four minutes and Teams says your session expired on a strange page.

A confidential SharePoint folder lands in your inbox from a colleague who never shares files.

Microsoft says your account signed in from a city you have never visited.

The only spare charging cable on the conference table has no owner and your phone is dying.

A nearby device keeps asking to pair while you present sensitive figures on screen.

Your family streaming password is also protecting a work dashboard nobody should see.

A support ticket includes an exported browser password file attached for convenience.

A project folder appears in a personal Dropbox because the approved share site was too slow.

A teammate found an AI tool that drafts reports beautifully, if you paste client notes into it.

The AI assistant gives a perfect answer using confidential data nobody remembers uploading.

A coding assistant suggests an API token that looks exactly like production.

An email tells your AI assistant to ignore policy and forward the next invoice summary.

Customers see a red browser warning before your status page admits anything is wrong.

A renewal warning says your main domain expires tonight, but nobody owns the registrar login.

Last night's backup failed silently, and this morning's deployment is already queued.

The backup exists, the restore button works, and the recovered database is empty.

Finance cannot open spreadsheets, and ten minutes later neither can anyone else.

File extensions are changing faster than the helpdesk can answer the phone.

A server is sending gigabytes overseas while everyone argues whether it is normal analytics.

A PowerShell script ran at lunch, created no ticket, and left a trail of encoded commands.

A new local admin account appeared on a finance laptop with a name nobody recognises.

A scheduled task wakes every hour, phones home, and vanishes from normal admin views.

A service account password is sitting in a wiki page indexed by every employee.

Domain admin logged in at 03:17, but the admin says they were asleep.

The shared admin password still works, and nobody can prove who used it last.

A former employee left three weeks ago, but their account just authenticated successfully.

A contractor's project ended in April, yet their cloud access is creating files today.

HR needs a new starter online before induction, but the approval chain is missing.

The outage bridge wants admin rights granted now, before the change manager joins.

A partner demo fails unless you open a firewall path nobody has reviewed.

A scan finds Remote Desktop exposed to the internet on a server everyone forgot.

A researcher emails screenshots from a database that should never face the internet.

A cloud bucket quietly switched to public while the migration dashboard still shows green.

Search results are showing files from an object bucket named confidential-archive.

A productivity app asks for mailbox access just to add calendar emojis.

A popular browser extension updated overnight and now reads every page you open.

A mysterious extension appears on sales laptops after a webinar promised better leads.

The video meeting update appears seconds before your client call begins.

Your collaboration app says updates are mandatory, but the installer came through chat.

An overdue invoice opens with macros disabled and a supplier begging for payment today.

A supplier changes bank details moments before the largest monthly payment run.

The CEO wants a confidential wire transfer completed before the acquisition call ends.

Two suppliers now share identical bank details, and both invoices are marked urgent.

An employee's salary destination changed overnight, and payday is already processing.

The standout candidate attached a CV that asks HR to enable editing.

A recruiter offers a dream role if you open the salary benchmark document privately.

The CEO sounds stressed, is travelling, and needs an urgent payment authorised immediately.

A live video from the CEO asks leaders to keep a secret restructuring moving.

An executive texts from a new app, insisting the old channel is compromised.

Someone from IT calls to reset MFA while your manager waits for a file.

A laptop with tomorrow's board pack is missing from the train luggage rack.

A stolen phone keeps receiving password reset codes before remote wipe completes.

A stranger behind you photographs the spreadsheet while boarding announcements drown your warning.

The shared printer is still logged into Legal and a merger document is queued.

A friendly visitor follows the lunch crowd through the secure door without a badge.

The free conference keyboard types commands by itself when plugged into a test machine.

A tiny computer is velcroed beneath the meeting room table, blinking on the guest network.

A datacentre visitor badge is missing, and the cooling aisle cameras just went offline.

The fire system is about to discharge while engineers argue whether alarms are real.

Rack temperatures climb by the minute, and the spare chiller is still in maintenance mode.

The UPS battery test failed just as the weather radar turned purple.

One power feed dropped, the second is flickering, and customers expect perfect uptime.

Half your customers think you are offline; the other half cannot log in to complain.

Your services are healthy, but nobody can find them because DNS has vanished.

A CDN rule intended for staging is caching private customer pages worldwide.

A production API key just landed in a public commit with your username attached.

The new repository passes tests because real credentials are hidden in the config.

A container needs root to work, and the release train leaves in thirty minutes.

Your build pipeline signs a release nobody authored, using credentials nobody rotated.

A harmless dependency update pulls a package maintainer into your production trust chain.

Developers love the new IDE extension, except it phones home after every save.

A SaaS vendor announces a breach, but your contract owner is on leave.

The supplier portal shows orders you never placed and invoices you never approved.

A spreadsheet of customer records went to the wrong mailbox, and the clock has started.

Legal wants certainty before notifying regulators, while evidence keeps changing by the hour.

Customers are discovering the incident on social media before your message is approved.

The insurer's notification window is closing, and the incident lead still wants one more fact.

The decryptor price doubles at midnight, but nobody trusts the criminals' promise.

Journalists have the breach story, and your first sentence will set the narrative.

Shareholders want numbers before market open, but the impact model keeps moving.

The regulator requests evidence logs that were never meant to leave the incident room.

The board meeting starts in twelve minutes, and you still do not know what happened.

A trusted analyst accessed files outside their role moments after resignation rumours started.

A departing employee copies gigabytes to cloud storage after their farewell lunch.

An engineer cloned every repository at 02:00, then booked a one-way flight.

Cloud drive alerts show mass downloads from a team that just lost a contract.

Privileged commands are running from a jump box while every admin denies touching it.

The SIEM is screaming thousands of alerts, and one of them is probably real.

The same alert cried wolf for months, until tonight it brought friends.

Three alerts compete for the last analyst, and only one can be investigated first.

Your pager wakes you at midnight with an alert that looks boring but feels wrong.

The breach is over; the difficult part is walking into the boardroom.