BREACH Rules Reference
Use this page when playing the attacker side of BREACH: build your team, prepare items, choose the situation, attack, and resolve the outcome.
Attacker Instructions
Round Start
- Create your team: Shuffle the Attacker Character deck, draw 6, select 3, and remove the 3 not selected from the game.
Note: There are only 2 Situation Cards per attack type. To win you must take all of your opponents Budget Points before you run out of characters. Every round after the first you will draw 3 and discard 3. - Gear up: Shuffle the Attacker Item deck, draw 10 into Available, and purchase what you can. Unpurchased cards stay Available for purchase.
Note: Every round you will draw 10 more cards which become Available for purchase. - Find an opening: Shuffle the Situation deck, draw 3, and select 1 to exploit. Place the 2 unused cards back into the deck.
- Plan your attack: Choose the Attacker Character that best fits the Situation and purchased items you will use. Only aligned characters and items add modifiers.
Note: If no characters or items align with the Situation Card, you can still attempt the attack. You just will not have any modifiers. - Attack: Read only the Situation text, NOT the Valid Defenses.
- After you read the Situation text, add flavor explaining how your character is going to attempt to exploit the vulnerability.
- Allow the Defenders to choose who they are going to defend with and with what tools.
- The Defenders have to say which character they are going to defend with, but not with what item just yet.
- Item cards can be used at any time, unless stated on the card.
- Then roll your attack, adding any modifiers that align with the Situation Card.
- Resolve: Use the Rolling & Resolving page to determine how damaging the attack was and how many Budget Points you stole.
Round End
Rolling & Resolving
After the attack and defense rolls, use the Rolling & Resolving page to apply the outcome, resolve High Alert, and update Budget Points.
Using Situation Cards
Situation Cards are prompts for creative security thinking, not rigid scripts. The attacker should use the card as a real-world scenario and explain a believable way that situation could be exploited.
