Welcome to the table. This page walks you through setup and your first few turns in the order you need them, with the full rules underneath — the same rules as the sheet in the box, just easier to read.
Hack Attack: Defense is quick to learn, and these three rules are what make it click. Get them right and the rest takes care of itself.
You may Protect one Tech card per turn
Protecting is free — it never costs one of your two actions — but it happens once per turn, not once per action. Play all the Defense cards the Tech card asks for, show them, then tuck them face-down under it.
More players, more matches
Every Attack card shows three Defense icons. With 2 players the table only needs to cover 1 of the 3. With 3–4 players, cover 2 of 3. With 5–6 players, cover all three — one Defense card per icon.
The game ends on the fourth Protected Tech card
Not after a set number of rounds, and not when the first Attack hits. When any player Protects their fourth Tech card (third at 5–6 players), everyone else takes one final turn, then you score. Expect 15–30 minutes.
- Sort the cards into four piles: Tech, Defense, Attack, and User Error.
- Shuffle the Tech deck and deal 4 Tech cards face-up in front of each player.
- Make the Tech row: draw 3 more Tech cards and lay them face-up in the middle of the table. Set the rest of the Tech deck face-down beside them.
- Shuffle the Defense deck and deal 4 Defense cards face-down to each player. These go in your hand and stay private.
- Make the Defense row: draw 5 Defense cards and lay them face-up near the Tech row.
- Add the Attacks and User Errors: shuffle all of them into the remaining Defense deck. Set that combined deck face-down beside the Defense row. (For a gentler first game, shuffle in fewer of them.)
- Pick a first player: whoever most recently ran into a scam goes first. Play continues clockwise.
You must take two actions even if you would rather not. Acquire twice, Secure twice, or one of each in either order.
Acquire
Take one face-up card from the Tech row and place it face-up in front of you, then refill the row from the Tech deck. You can never have more than 4 unprotected Tech cards in front of you — if you would go over, discard one first.
Secure
Take a Defense card from the Defense row or the top of the Defense deck and add it to your hand, then refill the row. You cannot lift a card in the row to peek underneath. A face-up Reality Check in the row costs both actions.
Protect a Tech card (once per turn)
Between actions, play every Defense card the Tech card asks for from your hand. Show them to the table, then turn them face-down on top of the Tech card. Draw a replacement Tech card from the row right away. This must happen before you reveal any new face-down Defense cards.
Resolve what you flip
If you draw or reveal a User Error or Attack card, deal with it immediately (see below), then refill the Defense row. Neither one uses an action.
End of turn: if you hold more than 4 Defense cards, discard down to 4. Discarded Defense cards go face-up on top of any card in the Defense row, completely covering it. Stacks can be any height.
Faster variant: let players Protect any number of Tech cards on their turn.
Tech
Shows the Defenses needed to Protect it and the points it scores (in the shield at the top). The bottom lists the Attack types it is vulnerable to while unprotected. Protected Tech is never discarded.
Defense
Each belongs to one of six categories: Backups, Device Security, Home Network, Passwords, Social Engineering, Social Media. Every card is a real method that secures devices and data.
Reality Check
A wild Defense card. Play or reveal it in place of any category. Taking one face-up from the Defense row costs both of your actions.
User Error
Check the category at the bottom. Reveal a matching Defense card from your hand to prevent it and pass it left; the next player must do the same. Whoever cannot keeps it: −1 point at the end. If everyone prevents it, it leaves the game.
Every Attack card shows three Defense icons along the bottom. Take Ransomware Infection, on the right: it shows Backups, Social Engineering, and Device Security. A category can appear twice on a card — Phishing Email shows Social Engineering twice — and each icon still needs its own Defense card.
- Immediate loss. The player who drew the Attack discards every unprotected Tech card in front of them that is vulnerable to that Attack. It is too late to Protect once the Attack is out.
- Everyone picks one card. Each player secretly chooses one Defense card from their hand and places it face-down. No talking, no coordinating.
- Reveal together. One Defense card covers one icon of its category. How many of the three icons the table must cover depends on player count:
2 players
Cover any 1 of the 3 icons.
3–4 players
Cover any 2 of the 3 icons.
5–6 players
Cover all 3 icons.
If the defense holds: all remaining Tech is safe.
If it fails: every player discards their highest-value unprotected Tech card (you choose on a tie) and does not draw a replacement.
Either way, take your Defense cards back into your hand, remove the Attack card from the game, and carry on with the turn.
Variant: for an easier or harder game, lower or raise the number of icons the table must cover.
When a player Protects their fourth Tech card (third with 5–6 players), every other player takes one last turn. Then:
- Add up the points on your Protected Tech cards. Unprotected Tech scores nothing.
- Subtract 1 point for each User Error card in front of you.
- Highest total wins. Tie-breaker: the tied player with the fewest Protected Tech cards. Still tied? Share the win.
The how-to-play video walks through a full turn and an Attack. If your table hits a situation this page does not cover, email me and I will answer it and add it here.