Dan’s Doughnuts, a fictional retail business with 12,900 stores worldwide and a $1.3 billion annual turnover, was hit by a ransomware attack. The attackers encrypted files, exposed staff identities, and disrupted critical IT operations, including finance, product distribution, and billing. The company faced a ransom demand of over $1 million in Bitcoin, with a 48-hour deadline. The attack left management blindfolded, unable to access the datacenter or monitor operations remotely. The lack of a ransomware response plan led to chaos, with no clear recovery order for IT systems. Immutable backups were compromised, requiring restoration in a clean room, and the board became involved, expressing anger over the impact on stock prices. The simulation highlighted the need for a well-defined attack response playbook and ongoing employee training.