Turn your lessons into experiences.
Lessons students want to explore, participate in and remember.
Edugine helps tutors create and run live learning experiences where students actively participate, interact and collaborate — while tutors see what students are doing and guide the lesson in real time.
Lesson
B2ENCyber Attack: 60 Minutes to Respond
Practice modals of obligation through a real-time cyber attack simulation. Your company's systems just went dark — lead the response, make decisions under pressure, and communicate to staff and clients when every second counts. A practical B2 English lesson on modals of obligation, cybersecurity vocabulary, and emergency decision-making. Ideal for adult learners, English tutors, and language schools.
How this lesson works
Students participate
Students interact directly with the lesson — responding, speaking, solving tasks, making decisions and joining activities.
You see what is happening
See student responses, answers, mistakes and activity in real time where supported.
You guide the experience
Guide the lesson, manage activities and timing, and respond to what students are doing where supported.
Everyone participates
Students actively contribute and interact instead of simply consuming lesson content.
You've Been Hacked — React Now. Drama Event
Drama Event
Scenario
It is 9:15 AM on a Wednesday. You arrive at work, open your laptop, and see a red screen with a message: "Your files have been encrypted. Pay $500,000 in Bitcoin within 72 hours or your data will be published online. The clock is ticking." Your entire company network is down. Email doesn't work. The phone system is offline. People are panicking. You are in charge. What do you do?
- 🎲
wordlist
Everyone must stop using their computers immediately. We need to contact our IT security team right now. Nobody should try to restart their machine — it could make things worse. We have to inform the CEO before we do anything else. You mustn't open any emails or click any links. We should disconnect from the internet immediately. Does anyone have access to the backup systems? We need to stay calm and follow the emergency protocol.
- 🧨
Crisis
The ransom message has appeared on every screen in the building. 200 employees are staring at red screens. Some are trying to restart their computers. One person is crying. Your receptionist is answering calls from clients who can't access their accounts. What are your first three instructions?
- ⏱
Pressure
Your CEO calls from an airport: "I just landed and my email doesn't work. What's going on?" You have 30 seconds to explain the situation. He asks: "Should we pay the ransom?" What do you say?
- 🧠
Revelation
Your IT manager arrives and says: "The attack came through a phishing email that someone opened on Friday. The malware has been in our system for five days — it was just waiting to activate." This means the hackers have had access to everything for almost a week.
- 🔄
Twist
A journalist calls the main office number: "We've received an anonymous tip that your company has been hacked and customer data has been compromised. Can you confirm?" Your PR person is on holiday. You must respond.
- 🚧
Constraint
Your IT manager says the backup server is also encrypted. The last clean backup is from three weeks ago. If you restore from that backup, you lose three weeks of work — contracts, orders, financial records. Some of it may be unrecoverable.
- 🎯
Decision
The hackers send a second message: "Pay $250,000 within 24 hours and we'll give you the decryption key. After 24 hours, the price goes back to $500,000. After 72 hours, we publish everything." Your insurance company says they might cover the ransom but need 48 hours to approve it. What do you do?
- 🧭
Opportunity
An external cybersecurity firm offers to help for €15,000 per day. They say they might be able to decrypt your files without paying the ransom — but they need at least 3 days and they cannot guarantee success. Do you hire them?
- 🧨
Crisis
An employee posts on LinkedIn: "Our company has been hacked and management has no idea what they're doing. Looking for new opportunities." The post has 300 likes. HR wants to fire him immediately. Your lawyer says you can't fire someone for telling the truth on social media. What do you do?
- 🎲
settings
- 🎲
settings
- 🎲
settings
- 🎲
settings
- 🎲
settings
Cybersecurity Vocabulary. Multiple Choice
Multiple Choice
What is "ransomware"?
- A security tool that protects your network from external attacks
- Malicious software that encrypts your files and demands payment to unlock them
- A type of insurance that covers losses from cyber attacks
- A backup system that automatically saves your files every hour
What is a "phishing email"?
- A secure encrypted email that only the sender and receiver can read
- A fake email designed to trick you into clicking a dangerous link or sharing personal data
- An automatic email that reminds you to change your password
- An email sent by the IT department to test your computer speed
What does "data breach" mean?
- A backup process where old data is permanently deleted
- A software update that temporarily makes your data unavailable
- Unauthorised access to confidential information, often resulting in data being stolen or exposed
- A planned transfer of data between two authorised company servers
What is "two-factor authentication"?
- A backup method that saves data in two different locations simultaneously
- A security process requiring two different forms of verification before granting access
- A system where two people must approve every email before it is sent
- A type of encryption that uses two separate passwords for the same account
What does "firewall" mean in IT?
- A physical wall in a data centre that protects servers from fire damage
- A legal document that protects a company from cyber attack lawsuits
- A software programme that automatically deletes spam emails
- A network security system that monitors and controls incoming and outgoing traffic
What is the "dark web"?
- A secure government network used for classified communications
- The private intranet that large corporations use for internal communication
- A part of the internet not indexed by search engines, often used for illegal activities
- A backup internet system that activates when the main network fails
Lesson Board
Lesson Board
First 60 Minutes — What to Do and When. Sequence
Sequence
- Disconnect all devices from the network to stop the malware from spreading
- Inform senior management and activate the incident response team
- Contact your cybersecurity provider or an external response firm
- Preserve evidence — do not delete anything, restart machines, or attempt fixes
- Notify your legal team and check data breach reporting obligations
- Communicate to all staff — clear instructions on what to do and what NOT to do
- Begin assessing which systems and data are affected
Cyber Response Team. Hidden Role
Hidden Role
Scenario
The ransomware attack is in full swing. The incident response team has assembled in a conference room with no internet, no email, and paper notebooks. The team must decide three things within 15 minutes: 1) Do we pay the ransom or try to recover without paying? 2) When and how do we inform our clients? 3) Who do we call first — the police, the insurance company, or the cybersecurity firm? But someone on this team may not be acting in the company's best interest...
IT Director
You are responsible for all technology systems. You know the backup is three weeks old and incomplete. You believe paying the ransom is the fastest way to recover, but you know it doesn't guarantee anything — hackers lie.
Secret goal: You should have upgraded the backup system six months ago. The budget was approved but you spent it on a different project. If the investigation reveals this, you are finished. Push for paying the ransom quickly because a full investigation will expose your decision.
CFO
You control the finances. The ransom is $250,000 if paid today. The cyber insurance policy has a $100,000 deductible and takes 48 hours to process. Recovery without paying could cost $500,000+ in lost business and consultant fees.
Secret goal: You want the cheapest option. You are leaning toward paying because the math works. But you also know that paying ransomware is controversial and might attract more attacks. Your real priority: protect the quarterly results, which go to the board next week.
Head of Legal
You manage legal risk. GDPR requires you to report a data breach to the authorities within 72 hours. If client data was stolen and you don't report it, the fines could reach €10 million.
Secret goal: You want to delay informing clients as long as legally possible because every notification increases the risk of lawsuits. Push for "we need to investigate fully before we say anything" — this buys time but may not be legal.
External IT Consultant
SpyYou were called in 30 minutes ago. You are an expert in ransomware recovery. You have handled 40 similar cases. You believe you can recover the data without paying, but you need 3-5 days and full access to the servers.
Secret goal: You are actually working for a cybersecurity firm that profits from long recovery processes. The longer this takes, the more your firm earns. You will subtly discourage paying the ransom and push for a "thorough investigation" even if paying would be faster and cheaper. Do not reveal your financial interest.
What We Should Have Done. Word Cards
Word Cards
- We should have...|Think of three things this company should have done BEFORE the attack. Start each sentence with "We should have..."
- We mustn't...|You are writing emergency rules for all staff. Write three "mustn't" rules about email and internet use.
- If we had...|Complete this sentence three different ways: "If we had updated our security, we..."
- We need to...|The attack is over. Write three "need to" priorities for the next 30 days.
- We must never...|What three things must the company never do again? Start each with "We must never..."
- Someone shouldn't have...|Without naming anyone, describe three mistakes that were made. Use "shouldn't have."
Cyber Lessons — Never Again. Speed Debate
Speed Debate
- Companies that pay ransomware hackers are funding organised crime and should face legal consequences.
- Most cyber attacks succeed because of human error, not technology failure — training matters more than firewalls.
- Companies should be legally required to tell customers about a data breach within 24 hours, not 72.
- If an employee clicks a phishing link and causes a major breach, they should face disciplinary action.
- Cyber insurance encourages companies to be lazy about security because they know they are covered.
- Small businesses cannot afford proper cybersecurity — governments should provide it for free.
- Hiring hackers to test your own systems is the best investment a company can make.
- In five years, AI will make most cyber attacks impossible to stop.
Why Edugine?
Turn your lessons into experiences.
Edugine helps tutors create and run live learning experiences where students actively participate, interact and collaborate — while tutors see what students are doing and guide the lesson in real time.