Chapter 8 - SOMEONE STOLE THE FILES WE HAD SAVED FROM ETHAN
At 2:14 on a Thursday morning, Mitchell Creative’s security team called Dana Morales.
At 2:18, Dana called me.
At 2:21, I was sitting upright in bed with Noah turning on a lamp.
“What?”
I put phone on speaker.
Dana said:
“We have a data incident.”
My stomach tightened.
“What kind?”
“Someone accessed legal archive.”
“Current client?”
“We don’t know.”
“Personal?”
“Yes.”
That one word woke every old fear.
The legal archive included historic Ethan diligence emails.
Whitmore correspondence.
Harbor National documents.
Internal investigation records.
Some sealed or privilege-limited.
Not all accessible to ordinary staff.
The company’s security monitoring showed a former contractor credential had been reactivated and used to download 4.8 gigabytes of files.
“Who?”
“Credential belonged to Caleb Ross.”
I knew name vaguely.
IT consultant.
Worked migration eighteen months earlier.
“Why active?”
“It shouldn’t be.”
“Where login?”
“Chicago VPN.”
“Device?”
“Unknown.”
“What do you need?”
“Nothing from you yet.”
Good.
No founder control.
Dana had already called:
Cybersecurity firm.
Outside counsel.
Insurer.
Law enforcement liaison because potential theft.
Document preservation.
Board.
Exactly.
I sat.
Could not do anything.
That was almost unbearable.
Noah watched.
“You’re pacing.”
“I’m not.”
“You’re pacing sitting down somehow.”
True.
At six, incident team briefed.
The attacker accessed a folder that included:
Whitmore lender records.
Olivia conflict review? Some.
My prenup drafts.
Ethan correspondence.
Emily-related files? Only what Mitchell legal had, including note photo and communications? Sensitive.
Domestic abuse details should not all be in Mitchell company archive, but some legal supporting records related to wedding cancellation and financial diligence. Still.
The attacker also downloaded client contracts and HR compensation reports.
This was company breach.
Not only personal.
Then ransom email arrived.
Not ransomware.
Extortion.
Pay $3 million or selected files go to media and competitors.
Deadline forty-eight hours.
The email quoted my old canceled-wedding documents.
My skin went cold.
Dana looked at me on video.
“We do not make decision alone.”
“Yes.”
Board crisis committee.
Cyber counsel.
FBI? We can say federal law enforcement notified due extortion.
No guarantee outcome.
Insurer.
We assessed.
Could paying prevent publication?
No guarantee.
Could violate policies depending recipient.
Need sanctions checks.
We did not immediately pay.
Good.
Then media received sample anyway.
One outlet emailed me:
We have documents indicating your former fiancé used Mitchell Creative financial data in Whitmore lending discussions. Comment?
Harbor review was already known privately, not public.
Now story.
Another:
Documents related to former Mitchell President Olivia Bennett’s undisclosed family vendor relationship.
Old, resolved.
Another:
Draft prenup documents.
Personal.
The attacker wanted humiliation plus business pressure.
Then Emily called.
“They emailed me.”
My stomach dropped.
“What?”
A scan of her four-line note.
RETURN AT 10.
USE SIDE GATE.
DON’T MAKE A SOUND.
She started crying.
“That is mine.”
I felt sick.
I had photographed and sent to Rebecca, then stored in legal matter.
Mitchell archive had copy because corporate investigation referenced timeline.
Too broad retention.
We had kept something deeply personal.
“Emily, I’m sorry.”
“For what?”
“My company had it.”
“You needed evidence.”
“Seven years later?”
Silence.
Exactly.
Data minimization.
Another lesson.
What should be retained?
Who controls?
We had secured but not minimized.
The breach exposed.
Then attacker sent a medical photo of Emily bruises? Did Mitchell have? Perhaps no. Better avoid gratuitous. It had written references, not photos.
Still devastating.
Emily said:
“If note gets published, everyone will make me woman in shed again.”
I closed eyes.
“We’ll fight publication where lawful.”
“Can you stop?”
“No.”
Honest.
She cried.
No false promise.
Then cyber team traced credential.
Caleb Ross said he had not logged in.
His password was in old developer vault.
MFA token had been transferred? The attacker used service account associated with him, not personal.
Internal configuration failure.
No evidence Caleb.
Then security logs showed download from IP tied to shared office suite leased by a public-relations consultancy.
Name:
Sloan Strategic Advisory.
My blood stopped.
Sloan.
Margaret Sloan? No, source's chief? Actually Margaret is Whitmore mother, no Margaret Sloan. That was another story. Here chief? No, no Margaret Sloan. We can introduce Olivia Sloan? Wait no need collision. Let's use Harbor Ridge Communications.
Owner:
Malcolm Price’s wife? Too convenient.
Maybe former Whitmore CFO Malcolm had hired media firm after termination. Let's make consultancy "Price Strategic Advisory" founded by Malcolm after Whitmore firing. But direct IP from their office implies him.
Search warrant? Law enforcement investigates. We should not convict immediately.
Then sample media emails used phrasing from current Whitmore dispute.
Was Malcolm retaliating?
His lawyer denied.
He said shared office had dozens tenants.
Facts.
We waited.
Then another clue:
Attacker knew which files would hurt employee trust.
They emailed union? not.
They released executive compensation report.
Employees saw.
My compensation:
$3.2 million total including equity.
Some angry.
Legal but private.
An anonymous staff post:
Lauren cuts bonuses when clients leave but makes millions.
Ouch.
Context:
Equity grants valuation.
Still.
Transparency forced.
Board asked whether accelerate planned compensation disclosure to employee trust.
I wanted no.
Then realized hiding because breach embarrassment.
We decided release clear summary internally.
Not every personal detail.
Explain.
Employee trust observer asked:
“Why should executives keep ratios private?”
Governance debate.
Breach had exposed real issue.
Not all leaked info merely weapon.
Then attacker published old Olivia emails.
Public.
Olivia called me:
“I thought that was done.”
“It was.”
“Now my kids can Google.”
I had no answer.
Information persists.
Then my own old emails to Noah? Company archive should not have. No.
The extortion deadline passed.
We did not pay because law enforcement/cyber counsel recommended against given inability to guarantee and recipient uncertainty.
More files released.
Clients.
No catastrophic secrets.
But trust damage.
The board commissioned breach review.
Root cause:
Legacy legal migration copied restricted archives into broader document environment.
A service credential remained active.
Monitoring caught after large download but too late.
No individual current employee sabotage.
System failure.
Then law enforcement identified likely actor through payment wallet and communications? Maybe need drama. A former subcontractor named Darren Pike who worked for a litigation-support vendor had sold credentials to a “reputation intelligence” broker.
Who hired broker?
This is tricky. Could tie Malcolm.
Investigation later found Malcolm Price had paid the broker $75,000 for “litigation research” after termination, but claimed he wanted evidence Mitchell caused his firing. The broker exceeded. Emails show Malcolm asked for “anything that shows Lauren Mitchell’s hypocrisy or unauthorized influence.”
That is bad.
Did he ask hacking?
No direct evidence.
Broker hacked/commissioned theft independently.
Malcolm faced civil/legal consequences for obtaining stolen data if he knew? He claimed didn't. Broker indicted for computer intrusion/extortion. Malcolm civilly sued and settled; authorities maybe no criminal charge due proof. Grounded.
Important not cartoon.
Then Ethan called.
Through counsel.
He offered records showing Malcolm had threatened to “take everyone down.”
Useful.
No friendship.
He cooperated.
The attacker was stopped? Some data already out.
Cannot unring.
Mitchell offered identity monitoring to employees, notified clients, regulators as applicable.
Legal costs huge.
Insurance covered portion.
No layoffs.
Then I apologized publicly/internal:
“Our company retained more historical sensitive material than necessary and failed to properly decommission a service credential.”
Specific.
No blaming hacker only.
Employees appreciated some.
Not all.
Then Emily asked:
“Can I ask you to delete my note?”
“Yes.”
From Mitchell systems.
Legal counsel confirmed investigation copies no longer needed after statutory retention? We retained with outside counsel maybe. Emily had original. Company deleted unnecessary copy.
She decided what to do with her original later.
Good.
Then breach became reason to redesign privacy.
Data minimization.
Access.
Retention.
No one gets permanent archive because “maybe someday.”
Rebecca said:
“Lawyers everywhere are offended.”
I laughed.
Then one file in leaked archive contained something nobody expected.
An unsigned memo from Ethan to me, drafted but never sent.
Date:
Two days before I visited Whitmore estate.
It said:
Lauren, I need to tell you my family is under financial pressure and they are looking at your company as part of a future solution. I think I can manage it, but I don’t want you blindsided.
I stared.
He had almost told me.
Like Eleanor draft? Similar theme but current story source doesn't have that. Fine.
Did Ethan write? Metadata from his computer. He never sent.
Why?
I asked through counsel.
He answered:
“I was afraid you’d cancel wedding.”
Exactly.
He knew truth might produce no.
So he chose silence.
The memo did not excuse.
It clarified.
He had conscience.
Ignored.
Again.
Then I realized our archive was full of alternate choices people almost made.
Drafts.
Warnings.
Emails unsent.
The line between life paths sometimes is not ignorance.
It is the moment someone knows enough to ask—
and decides not to.
That became chapter's cliffhanger? Need next.
Then Noah told me his law firm had just received a conflict notice.
North River Partners—our investor—had hired his firm on an unrelated acquisition.
Noah was not assigned.
But his firm wanted him on internal conflicts committee because expertise.
He said no.
Good.
Then the managing partner asked him something else:
Could he advise on North River’s rights under Mitchell shareholder agreement if breach triggered indemnification?
Now my husband’s law firm might be advising one of my shareholders against my company.
Noah recused.
But the conflict did not disappear.
May you like
And for the first time in our marriage, I wondered whether “separate professional lives” was enough—
or whether one of us would have to walk away from work we had earned.
Related Stories
