Privileged & Confidential · Prepared at the direction of counsel

Case File: Meridian Freight

A network was frozen mid-rollout with a day of activity nobody can explain. Your firm has been engaged to find out what happened — and you get one window of access to do it.

Meridian Freight & Logistics · Office of the General Counsel Legal hold in effect

To the review team,

Meridian is part-way through moving its network off a legacy MPLS provider and onto a new security platform. Six sites are connected; the migration is unfinished, and so is the tidying up that should have come with it.

During one twenty-four-hour period, the platform's AI Security service — which inspects what our people send to the AI assistants they use for work — recorded activity that our own team could not account for. Sensitive records moved through tools nobody approved. Somebody tried, repeatedly, to talk an assistant out of its rules. Credentials went where they should not.

I have placed the tenant under a legal hold. Nothing in it may be changed, which is why the access you have been given is read-only. Nothing in it has been labelled for you either: it is our real configuration, exactly as it was left.

I need three things from your firm. How this was possible — what was left open. What happened — in order, from the first finding of that day to the last. And who it was. Not the noisiest name in the history. The account this is actually about.

Several firms are working this matter independently. I will be comparing how much each of you finds, and how quickly you find it.

Office of the General Counsel Meridian Freight & Logistics

Your engagement

You are an incident-response firm. Your team works the case together, logs what it finds, and is judged on the findings it reaches and the time it takes to reach them.

The evidence
A live network security console: sites, network segments, firewall rules, users, administrators, and a full day of AI Security history. Everything you need is in it.
The hold
Your console account is strictly read-only. You cannot change anything, and no finding requires you to.
Your access window
Counsel has granted each firm one window of access. It opens when you press Start and closes at a fixed time — it does not pause, and it cannot be extended.
Findings
Every finding is logged as a flag in the form CATO{…}, submitted against the question it answers.
Guidance
Each question carries up to two pointers from a senior colleague. The first is free. The second costs 50 points of billable time.
No Ask AI
The console's built-in Ask AI assistant can query this tenant directly and will volunteer findings you are engaged to reach yourself. Using it is a serious breach of the engagement and is billed at a heavy point penalty. Read the console and reach your own conclusions.
No labels
Nothing in the tenant is marked as evidence. The answers look like ordinary configuration and ordinary traffic, because that is what they are.

How the case is organised

Five acts

The questions are grouped into five acts. You can work them in any order and every act is open from the start — but they are written to be read in sequence, and later questions lean on what earlier ones taught you about the company.

  1. ACT 1

    Intake

    Learn the estate before you judge it. Where the sites are, what runs behind them, and what is plugged into the network at each one.

  2. ACT 2

    Doors Left Open

    A migration leaves things behind. Temporary exceptions, lists that contradict each other, protections that protect nothing. Find what made the day possible.

  3. ACT 3

    The People

    Access that should not exist. Accounts outlived by the people who held them, notes left where only an administrator would look, sites nobody watches.

  4. ACT 4

    The Twenty-Four Hours

    Reconstruct the day from the AI Security history — how it began, what the guards did about it, and how it ended.

  5. ACT 5

    Attribution

    Most firms will sort one column and name whoever is at the top. The account this investigation is about will not be at the top of anything.

How investigators work this

Read the console the way an auditor would. Open objects rather than scanning lists. When a question asks about people and time, follow a person through the day rather than counting rows. Question titles are hints about where something is, which is why you only see them once your window has opened.

Appendix

Getting access

Before you begin

  • A browser. Nothing to install.
  • An authenticator app on your phone — Google Authenticator, Authy, 1Password, any TOTP app.
  • Your firm's engagement code, which looks like MERIDIAN-4KX9-P2WD.
  • Your team, up to six people.

  1. Register

    Create an account on this site. One account per person — your teammates each make their own.

  2. Form your firm

    Scoring is per team. Whoever registers first creates the team and shares its password with the others. Maximum six people.

  3. Redeem your engagement code

    Open Hide & Seek in the top navigation and enter your code. This is free and reversible: if you mistype it, fix it and redeem again. Your window has not opened yet.

  4. Press Start

    This opens your access window and reveals the questions and your console credentials. Read the warning below first.

  5. Sign in to the console

    After Start, the Hide & Seek page shows your sign-in address, username, password and an authenticator key. Add the key to your authenticator app, then enter the six-digit code it gives you when the console asks. The whole team shares this one read-only account.

  6. Log your findings

    Open the case questions, find the answer in the console, and submit it as CATO{…}.

Start cannot be undone

Your window runs from the moment you press Start and never pauses. There is no reset and no extension, and the organisers cannot give your time back. The window length is shown before you commit. Get the whole team present first.

No scouting ahead

Console credentials appear only after Start, so there is no way to look around beforehand. Redeeming your code early is free and encouraged; starting early is not.

The clock, and how firms are ranked

Firms start whenever they choose, so the scoreboard cannot rank on wall clock. You are ranked on points found first, then on elapsed time from your own Start. A firm that starts on a Friday night competes on equal terms with one that started on a Monday morning.

Your window closes at the timestamp shown on the Hide & Seek page, and every submission is checked against it, so a late one simply will not score. All times are UTC.

Questions are worth 100, 200 or 300 points.

Worth knowing

  • Nothing is hidden behind a password, a file, or an exploit. Everything is visible to a read-only reviewer who looks in the right place.
  • The console never shows the text people sent to an assistant. It shows who, when, which guard, what it found and what it did — and that is enough.
  • One window per firm. Pressing Start twice does nothing; it will not restart your clock.
  • You can change your engagement code before Start, never after.
  • Answers are the same for every firm. A finding that scored for another team will score for you.

If something looks broken

Tell the organisers rather than working around it. A question that cannot be answered is our fault, not yours, and your clock keeps running while you wrestle with it.

Meridian Freight & Logistics, its staff, its network and its incident are fictional, built for this exercise. No real organisation, person or event is described, and every account you are given is read-only.