2017 · Buenos Aires
A coffee chain's free Wi-Fi added a 10-second delay when customers connected, and used it to mine cryptocurrency in their browsers.
The RegisterA security arcade · Free · No ads
Attackers love your coffee break.
The minutes you step away are the minutes they need. Coffee Breach turns a break into practice: spot the vulnerable line, pick the right fix, and keep the breach board from overflowing.
- 10topics
- 960hand-written questions
- 10 minper round, at most
- NewDaily challenge every day
-cur.execute(f"SELECT * FROM- users WHERE id={uid}")+cur.execute("SELECT * FROM+ users WHERE id=%s", (uid,))
SQL injection · patched
The coffee-break window
What fits inside a coffee break
Picture a 15-minute break. Here is what published research says can happen inside that window, and just after it.
The fastest cybercrime “breakout” CrowdStrike has recorded: from the first hacked computer to the next one.
CrowdStrike, 2026The median time to fall for a phishing test: 21 seconds to click the link, 28 more to type in data.
Verizon, 2024The fastest ransomware run in a lab test: 98,561 files, about 53 GB, encrypted.
Splunk, 2022Your coffee break is over.
The average cybercrime breakout CrowdStrike saw in 2025. About two coffee breaks.
CrowdStrike, 2026The fastest quarter of intrusions Unit 42 handled reached data theft within 72 minutes.
Unit 42, 2026
62%
of breaches involved a human element, such as falling for a scam or making a mistake.
Verizon DBIR, 202636%
of U.S. adults surveyed suspect they had a security incident after using public Wi-Fi.
Panda Security survey, 2025Coffee, literally
2020 · Lab demo
A researcher took over a Wi-Fi coffee maker and turned it into ransomware: heater on, grinder spinning, beeping, ransom note on screen.
Avast2014 · London
In a café experiment, six people joined a fake free hotspot whose terms asked for their eldest child. It was a joke clause, and the researchers say they logged no user information.
F-Secure2024 · North America
Ransomware at a software supplier knocked out barista scheduling for about 11,000 coffee shops, and managers worked out pay by hand.
SecurityInfoWatchThe name
Why we called it Coffee Breach
It sounds like a coffee break, because that's the moment it's about, and the moment it fits into.
The break is the window
Attackers count on the moment people step away: an unlocked screen, a rushed click, a café network. The name is a reminder of that moment.
It fits in a coffee break
Every round ends within 10 minutes, and the Daily challenge is 10 questions, with a new set every day. You can finish one before your coffee cools.
Don't let it overflow
Blocks fall on the breach board while you play. Each correct fix steers them into place; misses let them pile up. When the pile hits the top, the network is breached.
A nod to Java, and the rest
Java is one of ten topics, next to Python, Go, JavaScript, PHP, C#, AI, cloud, GRC, and Everyday Security for people who don't write code.
The game started out as PATCH PANIC. We renamed it Coffee Breach, a name that says what the game is about.
How it plays
Find the bug. Ship the patch. Beat the clock.
Each round shows a short code snippet, or a scam text, email or settings screen for people who don't code.
Spot the line
Click the line that has the security problem. You get two tries.
Pick the fix
Choose the right fix out of three. A second miss costs one of your three lives, and the answer is explained.
Beat the board
Correct fixes guide the falling blocks into place. When the pile reaches the top, the network is breached and the round ends.
- AI & LLMs
- Cloud & DevSecOps
- C# / .NET
- Everyday Security
- Go
- GRC
- Java
- JavaScript / Node
- PHP
- Python
A new Daily challenge, every day
Every day at 7 pm Dallas time, a new set of 10 questions goes live, the same for every player. Compare scores with friends and coworkers, and keep your daily streak going.
Practice
No clock, no lives, nothing saved. Read why each answer is right.
Teams
A private weekly board for friends, coworkers, classmates or a club.
Live events
A QR code to join and a big-screen leaderboard for meetups and workshops.
Levels and badges
Every point is XP. Keep a daily streak and collect badges.
Two looks
Neon Arcade, or a calm Corporate look for playing at work.
Before you go
A coffee-break checklist
Four habits that close the window before you step away.
-
Lock your screen
Every time you walk away.
Windows: Win + L
Mac: Ctrl + Cmd + Q
Your phone too: 16% of U.S. smartphone users don't use a passcode, fingerprint or face lock (Pew, 2023). -
Keep work off café Wi-Fi
Use your phone's hotspot, or the VPN your workplace provides, for anything that matters.
-
Don't click in a hurry
Urgent message on the way out? Check who really sent it, and where the link really goes, before you open anything.
-
Mind who can see
Sit where people can't read your screen, or use a privacy filter, and keep passwords and codes out of view.
Make your next break count.
Free, with no ads and nothing to install. For adults 18 and over.
app.coffeebreach.com
Sources
Sources Where the numbers on this page come from
- CrowdStrike, 2026 Global Threat Report (press release, February 24, 2026): fastest recorded eCrime breakout 27 seconds; 2025 average 29 minutes.
- Verizon Business, 2024 Data Breach Investigations Report, p. 9: median of 21 seconds from opening a phishing email to clicking, then 28 seconds to enter data, in security-awareness exercise data from 2023.
- Splunk SURGe, Gone in 52 Seconds…and 42 Minutes (2022): fastest of 400 lab runs, a LockBit sample, encrypted 98,561 files (about 53 GB) in 4 minutes 9 seconds.
- Palo Alto Networks, 2026 Unit 42 Global Incident Response Report, section 3.3: fastest quarter of intrusions reached exfiltration in 72 minutes; 22% of incidents in under an hour (19% in 2024).
- Verizon Business, 2026 Data Breach Investigations Report, Executive Summary: a human element in 62% of breaches.
- Panda Security, The Perils of Public Wi-Fi: A 2025 Trend Report: survey of 1,014 U.S. adults, July 2025; 36% at least suspect a security incident after using public Wi-Fi.
- IBM, Cost of a Data Breach Report 2026 (research by Ponemon Institute): global average USD 4.99 million; U.S. average USD 11.5 million.
- Pew Research Center, How Americans View Data Privacy (2023): 16% of smartphone users don't use a passcode, fingerprint or face recognition to unlock their phone.
- The Register, Argy-bargy Argies barge into Starbucks Wi-Fi with alt-coin discharges (December 12, 2017).
- Avast (Gen Digital), The fresh smell of ransomed coffee (September 2020).
- F-Secure, Tainted Love: How Wi-Fi Betrays Us (2014).
- SecurityInfoWatch, Software supplier cyberattack disrupts Starbucks cafes across North America (November 2024, citing The Wall Street Journal).
Figures are as published in the sources above and describe those studies; they are not measurements of any particular workplace. Report names and trademarks, including Buy Me a Coffee, belong to their owners, and Coffee Breach is not affiliated with or endorsed by them. Java is a registered trademark of Oracle and/or its affiliates. "Support the cause" opens Buy Me a Coffee: tips go to Vishva Patel, the developer, for hosting, AI services and keeping the game up to date; Vishva doesn't aim to profit and intends to give anything left over to free security-education efforts run by others. Tips are optional and unlock nothing in the game.