Chapter 9 - THE TOKEN
The first thing Northstar's investigators asked me was whether Ryan knew my work passwords.
I said no.
Then I corrected myself.
"He knew one old password."
David Ellis sat across from me in a conference room on the seventeenth floor of Northstar's headquarters.
Our general counsel, Priya Desai, sat beside him.
A forensic analyst named Mateo Ruiz had three monitors open at the far end of the table.
I had been allowed into the building only for the interview.
My badge remained suspended.
The humiliation of that small red light at the security gate stayed with me all the way upstairs.
This was the company I had helped build.
I had led campaigns through two acquisitions, one near-collapse, and a public-relations disaster that would have ended weaker companies.
Now I needed an escort to reach my own conference room.
"How old was the password?" Mateo asked.
"Two years."
"Did you reuse any portion of it?"
"No."
"Did Ryan ever have your laptop PIN?"
I hesitated.
"Yes."
Priya looked up.
"Current PIN?"
"He knew it until last summer."
"Why last summer?"
"We changed endpoint policy."
Mateo nodded.
"Biometric plus rotating PIN."
"Right."
"Did he know your phone passcode?"
"Yes."
The word tasted terrible.
Of course he did.
He was my husband.
He ordered food from my phone.
He changed songs while I drove.
He used it to take pictures when I was cooking.
I had never treated six digits as a weapon because I had never thought the person beside me was collecting access.
Mateo turned one screen toward me.
"The hardware token was used correctly."
"Meaning?"
"Not cloned."
"Someone physically had it."
"Yes."
"Ryan."
Priya intervened.
"We can say someone physically had it."
I stared at her.
"My laptop and token were found in his storage unit."
"I know."
"How much more careful do we need to be?"
"Careful enough that defense counsel cannot quote us out of context later."
I leaned back.
Lawyers had become the punctuation of my life.
Mateo continued.
"The login at 2:13 a.m. came from your home internet connection."
"I was at the hospital."
"We have hospital admission records and your phone's location history."
"Good."
"The session lasted eleven minutes."
"What exactly happened?"
He showed me a timeline.
2:13 a.m. - authenticated login.
2:14 - employee equity database queried.
2:16 - executive compensation export generated.
2:18 - client contact list generated.
2:21 - Claire Bennett stock history opened.
2:22 - vesting schedule downloaded.
2:24 - archived board compensation packet opened.
2:24 - session terminated.
"Why the client contact list?"
Mateo shrugged.
"Maybe camouflage."
"Meaning?"
"If the real goal was your stock data, taking other files makes the breach look broader."
I thought of the forged deed.
The family asset agreement.
The ledger entry estimating my vested and unvested equity.
"They wanted to know exactly what my shares were worth."
David's expression hardened.
"Possibly."
"They already had an estimate."
"From where?"
I told them about Grant's ledger.
Priya wrote something down.
"Did the ledger show company information that is not public?"
"The total was close to my internal value."
"How close?"
"Within a few hundred thousand."
David cursed quietly.
"That could create a securities issue."
"For me?"
"For whoever used nonpublic information."
"I didn't."
"I know."
"The board doesn't."
David looked at me.
"The board knows the current evidence points away from you."
"But my badge is still red."
He did not answer.
That told me enough.
Mateo opened another screen.
"We also recovered browser telemetry from the laptop before it went offline."
"What did it show?"
"At 2:09 a.m., four minutes before the Northstar login, someone accessed a webmail account."
"Whose?"
"The address is partially masked in our logs."
"Can you identify it?"
"Not conclusively."
He zoomed in.
The visible portion read R.BENNETT followed by four hidden characters and a protonmail domain.
I laughed once.
"Conclusive enough for me."
Priya did not smile.
"Not for us."
Mateo showed the next entry.
The webmail session opened a message with an attachment called CONTROL_PACKET_FINAL.pdf.
My stomach tightened.
"Can you recover the attachment?"
"Not from endpoint telemetry alone."
"What did they do with it?"
"Opened it locally."
"Then?"
"The document remained open when the Northstar login began."
I looked at David.
"So Ryan was sitting in our penthouse at two in the morning with a document called Control Packet Final while using my token."
Priya said, "We can prove someone was."
I almost snapped at her.
Then I stopped.
She was not protecting Ryan.
She was protecting the evidence.
I was going to have to learn that distinction if I wanted to survive this.
"What else?"
Mateo pulled up network records.
"A second device was on your home network at the same time."
"Ryan's phone?"
"We need the MAC address to confirm."
"Can Summit Tower or my router provide it?"
"Your router logs can."
Jonah had already imaged the router configuration after police cleared the penthouse.
Mateo looked mildly annoyed when I told him.
"Of course he did."
"You know Jonah."
"Unfortunately."
David almost smiled.
Then the conference-room door opened.
An assistant handed Priya a sealed envelope.
She read the label.
"This was delivered downstairs for Claire."
My stomach clenched.
"From who?"
"No return name."
Priya did not hand it to me.
Security screened it first.
Inside was a single photograph.
It showed me entering the hotel lobby to meet Emily two nights earlier.
A red circle had been drawn around Emily's face.
On the back, someone had written:
ASK HER WHAT HAPPENED TO KATHERINE.
Naomi arrived twenty minutes later.
I showed her the photograph.
"Katherine Doyle," she said.
"The name from the storage unit."
"Yes."
"Do you know who she is?"
"Not yet."
Jonah joined by phone.
"I do."
Everyone in the room looked at the speaker.
"How?" I asked.
"Public records."
"And?"
"Katherine Doyle was Grant Bennett's business partner for six years."
"Was?"
"She died three years ago."
A chill moved through me.
"How?"
"Stroke."
"How old?"
"Fifty-eight."
Naomi's face stayed expressionless.
"Don't turn a natural death into a conspiracy because someone mailed a creepy photograph."
"I wasn't," Jonah said.
"You were about to."
"Actually, I was about to tell you that two months after Katherine died, Bennett Ridge Holdings acquired her interest in a mountain property outside Vail."
Naomi sat straighter.
"How?"
"Power of attorney."
Nobody spoke.
Jonah continued.
"Signed six weeks before her stroke."
"Notarized by?" I asked.
"Caleb Mercer."
The room went silent.
I looked down at the photograph again.
ASK HER WHAT HAPPENED TO KATHERINE.
"Who sent this?"
No one knew.
My phone buzzed.
A message from an unknown number.
YOU ARE LOOKING IN THE WRONG PLACE.
I showed Naomi.
Another message came.
THE LOAN IS NOT THE MONEY THAT MATTERS.
Then a third.
CHECK WHAT RYAN BOUGHT THE WEEK AFTER FRONT RANGE FUNDED.
Jonah spoke first.
"That's specific."
Naomi looked at me.
"Could be Brooke."
"Could be Ryan trying to send us somewhere useless."
"Could be Grant."
"Why would Grant help me?"
"He wouldn't."
Jonah's voice came through the speaker.
"I can search public asset records."
Naomi said, "Search legally."
"You really think I need that reminder every time?"
"Yes."
Two hours later, Jonah found it.
One week after the one point six million dollar FrontRange loan funded, Bennett Ridge Holdings had wired nine hundred thousand dollars to an escrow company in Nevada.
The escrow company handled private aircraft transactions.
"They bought a plane?" I asked.
"Not exactly."
"What then?"
"A fractional jet interest."
I stared at the screen.
Ryan had told me for years that Grant's businesses were struggling.
I had paid their property taxes twice.
I had covered Diane's medical deductible.
I had paid Brooke's graduate-school tuition when Grant said he couldn't.
They had borrowed one point six million dollars against my home.
Then they had spent nine hundred thousand of it buying access to a private jet.
My hands began to shake.
Not from fear this time.
From rage.
Naomi saw it.
"Do not text him."
"I wasn't going to."
"Your face says otherwise."
I put the phone down.
David looked sick.
"Claire."
"What?"
"There is another issue with the stock file."
I turned toward him.
"What now?"
Mateo pulled up one final log entry.
"The person using your token did not only view your vesting schedule."
"What did they do?"
"They opened a board memo about a potential secondary tender offer."
I knew the memo.
Northstar was privately held.
Every eighteen months, the board considered allowing employees to sell a portion of vested shares to outside investors.
The next tender window had not been announced.
If approved, my vested shares could become liquid within weeks.
"How much would mine be worth?"
David did not answer immediately.
He did not need to.
I already knew the rough number.
Four point eight million dollars.
The same number in Grant's ledger.
Mateo said, "The board memo included a proposed eligibility date."
"When?"
"February first."
Six weeks before my due date.
Naomi looked at the family asset agreement again.
It would have transferred my stock into Bennett Ridge.
The incapacity clause would have placed control with Ryan.
The tender offer could have converted those shares into cash.
The penthouse loan suddenly looked less like the main crime.
It looked like bridge financing.
Money to keep Grant's world afloat until my stock became liquid.
I looked at the anonymous message.
THE LOAN IS NOT THE MONEY THAT MATTERS.
Whoever sent it knew exactly what Ryan was waiting for.
Naomi asked the obvious question.
"Who besides the board knew the tender window was being considered?"
David counted on his fingers.
"Board members, finance, legal, a few executives."
"Claire?"
"Yes."
"Ryan?"
"Not legitimately."
Jonah joined the call again.
"What about calendar leakage?"
David frowned.
"Meaning?"
"If Claire had a board-prep meeting titled Tender Review on a shared family calendar, Ryan wouldn't need to breach anything to know something was coming."
My stomach sank.
I opened my calendar history.
There it was.
BOARD PREP - SECONDARY TENDER OPTIONS.
I had marked it private in my corporate calendar.
But months earlier, I had manually copied travel and late-night meetings into our family calendar so Ryan would know when I was unavailable.
The title had carried over.
"So he may have known the event existed before stealing the memo," I said.
Jonah nodded.
"Then he used the token to get valuation and timing."
The idea made the scheme feel even more invasive.
Ryan did not need to hack some distant system first.
He watched my ordinary routines.
He noticed calendar entries.
He listened when I complained about board meetings.
He asked casual questions at dinner.
The breach was only the final step in intelligence gathering that had happened inside marriage.
David looked angry now.
"We're changing how executive data is mirrored to personal calendars."
"Good," I said.
Then I looked at the anonymous message again.
The sender knew not only that Ryan was waiting for liquidity.
May you like
They knew enough to distinguish the bridge loan from the real target.
Whoever sent it knew exactly what Ryan was waiting for.
