Active Dossiers

A 16-year-old student at Lëtzebuerg Digital High School, Alex Mercer, woke up to dozens of panicked messages from classmates. Someone had taken over Alex's Discord account overnight and used it to spam a fake "Free Nitro" link to everyone in the school's gaming server — and several students clicked it, losing their own accounts in a chain reaction.

Alex swears they never clicked anything suspicious. Their password was strong. 2FA was on. Yet the account was fully hijacked with no login notification and no 2FA prompt triggered. How is that possible?

As a Cyber Detective, your mission is to examine the digital trail — login logs, suspicious emails, downloaded files, and witness statements — and identify who engineered the attack and how they bypassed every security measure Alex thought they had.

The official Instagram account of the university's Robotics Society, @LuxRoboticsSociety, was compromised overnight. Several false and damaging posts — including fabricated announcements and offensive comments directed at rival clubs — were published just hours before the Society's biggest recruitment event of the year.

The club president, Nora Fischer, discovered the posts this morning and immediately deleted them, but screenshots have already spread across campus group chats. In the days before the incident, several club officers, including the account manager, received a suspicious email claiming to be from Instagram support.

Nora has asked the investigators to determine exactly how the account was accessed, and to identify who is responsible, before the damage to the Society's reputation gets worse. Three people have some connection to the account or its management, whether through current access, past access, or technical involvement. Investigators must examine the available evidence, question each suspect, and ultimately name the individual responsible for the breach.

The University Esports Society runs one Instagram account with 14,000 followers. One account, one password, shared by the four committee members — and two-factor authentication switched on, with the login codes texted to the registered phone number.

At 23:47 on Thursday, that account posted a "NordVPN giveaway" linking to a fake login page. At least 60 students typed their Instagram passwords into it before the account was locked. Eleven minutes later, at 23:58, the account password was changed and all four committee members were locked out of their own society page.

Here is what makes this case worth your time: the two-factor authentication worked perfectly. Instagram sent the code to the registered phone exactly as designed. The attacker still got in. Somebody handed the code over.

Four people had the password. One of them gave away the code. Neither of those two is necessarily the person who took the account. Work out who logged in at 23:40 — and don't stop at whoever looks most guilty.