Breach Escape — Gamified Incident Response Training (Escape Room, SCORM / HTML)

▶ Try it first: play Room 1 free in your browser — triage the signals, feel the clock start. Nothing to install.

A breach is unfolding at 8:47 on a Monday morning, and you're the on-call responder. Breach Escape is a 30–40 minute browser-based escape room built by a working privacy practitioner: five locked rooms that mirror the real incident-response lifecycle — Detect → Scope → Contain → Assess → Notify — with a 72-hour breach clock that starts ticking the moment awareness attaches, not when your investigation finishes. That's the lesson most training never lands, and here your learners feel it: every mis-triage, every over-scoped system, every wrong containment call burns hours you'll want back at the filing deadline.

What's inside:

• Five playable rooms — inbox triage, an evidence board, a one-shot containment fork with real consequences, a multi-regime notifiability assessment (GDPR / UK GDPR / California / Texas / HIPAA-BAA), and a notification you assemble block-by-block under the clock.
• The traps practitioners actually see — the encryption "safe harbor" that valid credentials defeat, the root-cause report that's fiction two days in, calling affected individuals before counsel review.
• Replayable by design — the compromised folder changes between runs (health data, government ID scans, or a children's roster), so the Room 4 analysis changes with it. Three plays, three different defensible determinations.
• Two-track scoring — a pass/fail completion score for your LMS and auditors (70% mastery threshold), plus a Gold / Silver / Bronze responder grade and a shareable end card for learners.
• Personalized debrief — every run ends with a narrative debrief built from the choices that learner actually made.

Formats: single-file HTML (runs anywhere, zero install, zero tracking — no cookies, no storage, no analytics calls) and a SCORM 1.2 package that imports into any mainstream LMS and reports completion, score, and pass status. Works fully offline.

Pairs with: the Privacy Incident Response Tabletop Kit — rehearse it live with your team, then let every employee drill it solo.

Training simulation for awareness purposes — not legal advice.