Sydney McEnroe speedwalked off the 3 Train and sprinted up the stairs two at a time. Upon reaching the top, she lowered her head and started running. Her phone buzzed in the pocket of her navy blue pantsuit, but she kept running. She could feel her legs from this weekend's training, but she kept running. Her lungs were stinging from the cold February air, but she kept running.
She arrived at the venerable JR Eastman building in Wall Street at 5:45 a.m., nineteen minutes earlier than usual. She flashed her badge at the night watchman.
The elevator crawled to the 57th floor. She paced, tapped her feet, rolled her neck, snapped her fingers against her thigh. Finally, the doors splayed open and she sprinted through the still-dark hallway, overhead fluorescent lights blooming and dying in her wake.
Upon entering her glass-enclosed office, the lights turned on and the computer monitor came to life. She dropped her gym bag on the floor and kicked it under the guest chair in the corner. Commuter sneakers off. Work heels on.
The espresso machine in the corner turned on. She looked at her watch. Exactly 5:50 a.m. From the pocket of her trenchcoat she retrieved a 250-gram bag of Yirgacheffe Ethiopian coffee beans and threw it on the desk. Coffee would have to wait. She peeled off her trenchcoat and tossed it onto the guest chair.
She pulled her phone out. The screen displayed a cascade of frantic messages, each decorated with a red stop sign, yellow triangle, or red siren.
Each ping, another piece of bad news.
System breach at the core level!
Transactions frozen!
Authorization protocols failing.
Her body registered the threat before her mind could process it -- pulse spiking, breath going shallow, the familiar tightness behind her sternum that meant the system was under load. She'd spent a year hardening this infrastructure, stress-testing every node, running failure scenarios until three in the morning. She'd made it hers. And now someone had walked right through the walls she'd built.
Carla Hughes popped her head over her cubicle wall and locked eyes with Sydney from halfway across the floor. She pointed to the stairs, indicating she'd run downstairs to confirm what was happening.
Sydney knew who would be in early -- Carla, always at 5:40, except on Thursdays, and Jimmy Raglan, who arrived at 6:05 after CrossFit but pretended it was 6:00. She knew who had school dropoff and mentally filed when they'd walk in the door. She knew who left early for yoga class. She knew who stayed late to meet up with friends on Thursdays. She had to know who she could count on.
If her hunch was correct, this would be the team she would need to count on today. They had barely a year together and she wasn't sure about them yet. Don't let me down. The thought surprised her. She wasn't sure if she meant them or herself.
Another text. Lina. The preview: “You left without...”
Sydney's thumb hovered for a half-second. She could see the shape of the sentence Lina was writing -- the hurt, the confusion, the morning they were supposed to have before everything went sideways. She swiped it away. Filed it mentally under “later.” The same folder where she'd been filing Lina for months now, the one that never seemed to empty no matter how many times she promised herself she'd get to it.
She looked through the glass walls at the rest of her team in their cubicles. One engineer was banging on his keyboard in a futile attempt to coax his terminal window into action. Another engineer kept trying the same command over and over and over. Beyond them she could see others trickling in and getting the panicked low-down from their teammates.
Sydney wiped her damp palms on her blouse, her slacks. She closed her eyes, inhaled, and held her breath for a count of four. She pressed her palms forcefully onto the table top. When that failed to calm her nerves, she fell into her chair. This wasn't a drill. This was the plan for when the plan failed.
She opened her laptop and tried to look at her dashboard. Failure.
She opened a terminal window and rebased the bank's code. She tried to run a version of the bank's software locally. Failure.
She tried to log into the database, the heart of the bank. Failure.
The bank was down.
Four trillion dollars in assets under management. Hundreds of billions in transactions every day. Tens of millions of accounts. All down.
She closed her laptop. For an eternal few seconds she went through all the possibilities. They kept pointing to one thing. Only one thing. She wasn't one for prayer, but had she been, she would've prayed it wasn't the case.
From within her desk, she retrieved a red three-ring binder. Her hand lingered on the binder a beat too long. She could feel her pulse in the joints of her fingers.
The binder was twenty-six years old. Its edges were frayed and held together with duct tape. The middle ring closed slightly askew. She started it on September 11, 2001. The horrors of that day led to writing her first contingency plan in the margins of a fifth grade math worksheet. Since, the binder contained detailed accounts of stairwells, exits, and impossible, unimaginable scenarios, all geared to satisfying a particular longing: to be prepared at all times for all things.
Now, the fear wasn't theoretical. It had breached the perimeter.
She flung the binder open. Within it were several tabbed sheets printed on heavy card stock. She flipped past “Terrorists” and “Hostage Crisis” to the one labeled “Hack.” She sat in her chair, adjusted her jacket, and cleared her throat.
The first item on the checklist was, simply, “Breathe.”
She did as she instructed herself to do.
The second item was “Notify the Secret Service and FBI.” Phone numbers were printed next to each, along with a name of Special Agents in each organization.
“Melanie!” she called.
A middle-aged woman in a gray, ankle-length tweed skirt and neatly pressed pink blouse appeared in her doorway, her Moleskine reporter's notebook and blue pen at the ready. Melanie, always prepared.
“I need you to contact the Secret Service and FBI. Tell them it's me and that I am calling for a Trident Period.” She scribbled names and phone numbers on a yellow Post-It and handed them to Melanie.
Sydney had pre-loaded contacts at all federal agencies with their own checklists. She had carefully selected members of both organizations' financial task forces who were as particular and professional as she was. Cultivating relationships with intense people who got shit done -- Melanie included -- was her specialty.
Sydney's counterparts in the government would know what the “trident” codeword meant: the tip of the spear, the most salient -- and dangerous -- thing. She expected an FBI Supervisory Special Agent from the Cyber Division at JR Eastman headquarters within the next half-hour, and together, the two of them would join the CEO immediately after arrival.
She closed her eyes and then clapped her hands. Melanie knew the tell and had her pen positioned to write.
“Tell Carla and Jimmy we are in Trident. Call an All-Hands. I want to address everyone within the next fifteen minutes. Notify any non-engineer and non-analyst at home or en route not to come into the office today unless I specifically ask for them. Notify security and everyone here that we are at stage one lockdown. Step away from computers, turn off phones. Literally, turn them off. And -- ”
“No one leaves the building.” Melanie, always a step ahead.
“And no one leaves the building. And tell Paul I'm coming to see him.” She tapped the page with her hand. “And get me IT.”
Melanie nodded and left. The Trident Plan was in motion.
Binder in-hand, Sydney bounded up six flights, skipping every other step. She felt burning in her legs as the nexus of weekend marathon training and her thirty-something years on the planet conspired against her. Thirty-seven was not twenty-seven.
Paul's assistant held up a finger as she approached. Through the glass, she could see him on the phone, pacing behind his desk. She waited.
The walls of his reception area were lined with photographs. Paul shaking hands with two presidents. Paul ringing the opening bell at the stock exchange. Paul at a ribbon-cutting in Des Moines, his hometown, where he'd grown up in a house smaller than this waiting room. He liked that story. Told it often -- at town halls, in interviews, to new hires who needed to understand that JR Eastman was a meritocracy. Bootstraps. Job creators. Words he used so frequently they'd lost all meaning, if they'd ever had any.
She'd heard the speech at her own interview. Had believed it, mostly. Still did, some days.
Paul's assistant caught her eye and nodded toward the door. Paul had hung up.
“What is the situation?” he asked once she entered.
She noticed his computer was off, and the Ethernet was disconnected from the wall. On his desk sat his two new iPhones, each turned off -- and without cases, as only the rich and carefree were wont to do. A box with a Motorola burner phone was unopened and on the credenza behind the desk.
He waved a laminated checklist she'd given him ages ago. “I do listen, you know.”
She almost smiled. Almost.
“Secret Service and FBI are on the way. Lockdown is in effect. We don't know who or what, but we should have clues soon. Carla's in the data room. Jimmy will sweep the logs as soon as he gets in. We have people in Finance auditing the balance sheets. Everyone's moving.”
“Hypotheses?”
“State-sponsored? Could be Lazarus, like Bangladesh. A bit early to know for sure. But this isn't amateurs. It's precise. Like MGM, but sharper.”
“Next steps?” Paul asked.
Sydney nodded towards the laminated card. “We work the problem.”
“I pay you to make sure this doesn't happen.” He was at the window now, watching the city awaken below. Slowly, he turned to face her -- six feet of Iowa corn-fed bulk in a suit that cost more than her first car, silver hair cropped close, the jaw of a man who'd played linebacker at a state school before discovering that finance paid better. His eyes were the pale blue of a winter sky, and just as warm. “And here we are.”
Sydney met his gaze and held it. “We work the problem.”
He waved her off. “Go.”
Back at her office, the troops had gathered. “Your FBI contact is 6 minutes out,” Melanie said, handing Sydney a microphone. “An FBI Cyber Action Team has been activated. They say they should be up and running within an hour.”
Sydney climbed onto a desk in the middle of the cubicle farm. Forty faces looked up at her. Maybe fifty. She'd hired maybe half of them. Inherited the rest. She knew their strengths, their blind spots. In some cases, she knew -- and judged -- their coding style. She had yet to see the ways they each handled the pressure. She knew that half of them had never seen a real attack. They'd run drills. They'd studied case files. But this was different. This was the thing itself.
Out of the corner of her eye, she saw Carla shaking her head, arms crossed in an X -- the signal they'd established months ago. Not ready. Don't start yet. Sydney gave her a quick nod. Carla held up five fingers, then pointed to the back of the room where two engineers were still making their way in from the elevators.
Sydney waited. She'd learned that from Carla, actually. Her first week at the bank, she'd launched into a crisis briefing before half the team had arrived, and Carla had pulled her aside afterward. “You only get one chance to set the tone,” she'd said. “Make sure everyone's in the room to hear it.” Sydney had bristled at the time. Now she understood.
Carla dropped her arms and nodded. Go.
Sydney tapped the microphone. “Team, as you can tell, almost ninety minutes ago, we were attacked and hacked. Whoever did this is as sophisticated as they get. Our trading systems are currently down.” She cleared her throat. In the back, a thin woman with fashionable glasses and a primly pressed white blouse signaled thumbs-up. “Cash and cash reserves are safe,” she went on, “and no securities have been transferred in or out. Markets don't open for a while yet, so the full effect of our systems being down hasn't quite trickled out to the rest of the company.”
She scanned the room. Some faces she recognized from late nights and weekend deployments -- the ones who showed up when things broke. Others she knew only from org charts and performance reviews. Right now, they were all looking at her the same way: waiting to be told what to do. That was the job. Not fixing the problem herself. Making sure everyone else could.
She motioned to the elevators. “Our systems are generally hardened, but the many connected building systems may not be. We all know what happened at MGM. I advise using the stairs until we have the time to audit and secure those systems, simply as a precaution. Until we know the particular attack vectors, your phones must remain off. Your managers have burner phones in their desks that you can use to contact your loved ones, if necessary.”
A murmur rippled through the room. Phones off. That was when it became real for most people. Not the trading systems, not the network diagrams -- the moment they couldn't text their kids or check on their parents. Sydney understood. She'd felt the weight of her own phone in her pocket, the unanswered message from Lina still sitting there.
“So far, that's what we do know. What we don't know is who caused this or what they intend to do next. We don't know if this is an advanced persistent threat and how long it has been lurking in our systems. We don't know what data has been compromised and why they haven't touched the money. For that, it's all hands on deck. Jimmy is going to start assembling the full logs of all our systems dating back to a year ago. We will start poring through these as a team. We are looking for anomalous activity. You'll know it when you see it.”
Sydney gave it a beat and looked around the room to ensure all eyes were on her before continuing. She looked at Carla, who gave her a small nod. Almost done. Bring it home.
“We are in the middle of a high-tech bank heist and we don't know if the robbers are still in the building. You all know your jobs. We've trained for this. Let's go.”
Melanie motioned Sydney to the stairs, and Sydney began the fifty-seven-story descent to the lobby. Melanie followed dutifully behind, carrying the red binder and her Moleskine notebook. As they moved down the stairwell, Sydney fired off orders that Melanie captured without breaking stride. “Put someone in charge of briefing people as they come into work.” “Make sure Carla and Jimmy are with me in emergency staff.” And so on, as ideas popped into her head.
In return, Sydney received an avalanche of Slack messages from her team giving her real-time information on progress. She nearly tripped on floor 31, but she recovered quickly and kept sending orders and receiving information.
Her phone buzzed again. Lina. She silenced it without looking.
Upon entering the lobby, an athletic woman in a black pantsuit waited for her. Sydney passed through the exit gates towards her with Melanie in tow.
JR Eastman occupied the upper 40 floors of the 63-story JR Eastman building on Liberty Street in Manhattan. The building itself was an architectural marvel, a glass and steel paean to the butterfly, and it never failed to strike Sydney with awe.
The cavernous lobby was usually full of busy New Yorkers coming and going with purpose, but now, with the new security protocols, the lobby line stretched to the revolving doors. Sydney counted heads. Forty-three people waiting. By eight o'clock, it would be four hundred.
“Special Agent Torres.”
Sydney shook her hand and introduced her to Melanie. “This way, please, Agent Torres. We are all in the basement.”
She badged through the gate readers to an armed security guard waiting on the other side, then reached into her wallet to produce her New York State Driver's License. Agent Torres followed behind, showing her government-issued badge and presenting secondary identification.
“We are in lockdown,” said Sydney.
Once the agent was cleared through security, Sydney motioned her towards the elevators and offered to brief her on the way.
The three of them continued into the main entrance of the bank, past the oak-paneled elevator bay, to a barely visible door that opened inward with a light touch. They took four flights of stairs down and were greeted by scruffy Jimmy Raglan, who regularly delighted in flaunting the corporate dress code as only a West Coast born-and-bred engineer could.
Jimmy's hair was wet from his workout, and he was fumbling with his tie with one hand and trying to type with the other. He noted Sydney's arrival and without fanfare gave her his rundown. “No physical breach. However they got in, they didn't do it from outside the building. At least not today,” he said. “We are still auditing the logs further back and should have more in the next couple of hours. So -- ”
“So we're looking at a long-dormant intrusion,” Sydney said. “Probably months. Maybe longer.”
Jimmy blinked. “I was going to say -- yeah. That's probably right.”
Sydney caught herself. She'd done it again. Finished his sentence. Jumped to his conclusion before he could reach it. She made herself wait.
“Are you prepared to brief?”
He hesitated.
She didn't repeat the question. She waited.
Jimmy's fingers paused over the keyboard. A flicker of something -- checking her face, maybe gauging how much detail she wanted. “With whatever information I have now. It's not much, but it will do.”
Sydney nodded as everyone entered the subbasement boardroom.
The Bunker was four floors below the lobby. Windowless. Faraday-caged, if necessary. The kind of room that made you forget sunlight existed. It smelled like a damp parking garage. Every inch of the three walls was empaneled with television monitors.
Today, the Bunker was full of the company's principal legal, public relations, and engineering managers.
Paul entered soon after everyone was seated. He touched shoulders, remembered names, made everyone feel seen. Sydney watched him work the room and sensed he was . . . not angry, exactly, but exhausted.
He was good at this. The people part. The part where leaders make people feel comfortable coming to work.
Sydney started. “We can rule out physical breaches, at least in the time period immediately before today. We can get the elevators moving and you can use your phones again.”
After summarizing the remainder of the situation, Sydney motioned for the room to provide input. Jimmy started speaking, tie in hand. He flopped the knotted mess on the table in front of him.
“We've definitely got a long-running, possibly long-dormant, malicious actor in our system,” he said as he plugged in his laptop and projected Java computer code on the screen. He highlighted a section. “This code was executed at 4:23 this morning. It caused four databases to effectively become inaccessible. It changed access credentials to the databases and locked our programming logic from accessing data.”
“Jesus. Is our code safe now?” Paul asked.
“You remember six months ago, we went through that full security audit?” Jimmy said. “Nobody wanted to do it, but it turns out it was kinda useful. The auditor recommended that we implement multi-factor authentication for all privileged accounts. We rolled it out last August during the slow summer months. Since we had superuser privileges locked down by physical Yubikeys, I was able to get in and reset the compromised credentials.”
Sydney leaned forward. “What about the databases themselves?”
“That's where it gets messy,” Jimmy said, pulling up terminal windows on his laptop. “Right now, we only have read access to the database. We are locked out from using it for anything meaningful. I tried restoring from our most recent clean backup, but the malware has persistence mechanisms. It reinfects the moment we try to restore write access.”
“Restore from cold storage backups?” Paul asked.
“Already tried in a sandbox environment,” Jimmy said, highlighting infected code on his screen. “Whatever this thing is, it's got hooks deep in the database layer. Probably embedded in stored procedures or triggers that execute automatically. Kind of like Bangladesh Bank or the Maggie backdoor from a while back. It's hard to say when it was introduced, but it's in all the backups through at least four years ago. That's as far as I got before coming down here.”
Carla shook her head. “The databases are going to be our biggest problem. Even if we've cleaned the application layer, there's likely a payload sitting dormant in the data itself -- ”
“Waiting to reactivate,” Sydney finished.
Carla tipped her head in agreement.
“So the question is how we get clean data when we can't trust the backups.”
Paul rubbed his temples. “So our application code is secure, but our data is poisoned. How do we restore the database, and how do we prevent this from happening again?”
“That,” Carla said grimly, “is the billion-dollar question.”
“Our top priority is to answer your first question,” Sydney said, “about restoring the database. As for preventing it, we are going to need FBI and Secret Service help.” She motioned towards Agent Torres. “Without knowing who did it, it's hard to figure out how.”
“The way our system is built,” Jimmy added, “is that our codebase is in a repository that's available to the company. We effectively separated the code that runs the bank from the database that contains all the user data. We have secured the codebase, though we're running another audit on those systems to make sure no one who wasn't authorized to read the data got it. This means that it could have been anyone in the company.”
“We should start by getting a list of everyone who has ever had access to your code,” Agent Torres said. “Sometimes people give things away without knowing what they're giving or even to whom.”
Sydney motioned to Melanie, who flashed a thumbs-up. “You'll have it within the hour,” she said as she typed a message on her phone.
“The other thing I can do is give your team access to all our backups,” Jimmy added. “If you find out when the malicious code was introduced, you could maybe narrow down who did it.”
Paul stood. “Okay, we have two paths. Path one is figure out who did this. Admittedly, not likely to change the outcome or help us get back on our feet. But that's a criminal matter for the FBI.”
Torres nodded and took notes.
“The second path, and the more pressing matter,” Paul went on, “is what I want everyone at this institution focused on and that's getting access to the database, no matter what it takes.”
Jimmy put his index finger in the air. “When I looked at access credentials earlier, I noticed something peculiar.” He projected a different window to the screens around the room. “Here's a table of all users who have access to the database and their level of access. You can also see timestamps of log-ins. Most of these rows are innocuous. Every software developer in the bank has read-only access privileges, while some have write privileges. But those write privileges do not grant sufficient access to change anyone else's access privileges. For that you need ‘superuser’ privileges.”
“I see two accounts there with ‘superuser’ privileges,” Sydney said.
“Yup, good eye. The ‘admin’ account is the one that was hacked into this morning, as you can see from the timestamp. There's this other account we can't make sense of. An account named ‘Gaya1973.’”
“Why would there be a second superuser account?” Agent Torres asked.
“That's the question,” replied Jimmy.
Paul gasped. “Holy shit.” Everyone turned to face him. “It's incredible that she'd do this.”
“Who?” Sydney asked. “Do what?”
“Gayathri Ramaswamy,” Paul said.
“A disaffected employee?” Agent Torres asked.
“Hardly,” Paul said. “I was Gaya's intern when I started at the bank.”
Sydney asked who Gayathri Ramaswamy was at the same time Agent Torres asked,
“Are you sure she's not behind this?”
“Gaya,” Paul said, pausing as if processing a wave of memories. “She's only the heart and soul of the bank. And, no, Agent Torres, she would never do anything to harm us. She loved working here almost as much as she loved her own children.”
“Wait,” Jimmy said. “Is she the one in the engineering orientation video? The one that goes from how to check in code to what to do in the event of a nuclear attack within about thirty seconds?”
Paul almost smiled. “We used to tease her about that video. She said we'd thank her someday.” He looked around the room. “Turns out she was right.”
“Why don't we just bring her in?” Agent Torres asked.
“You can't,” Paul said, staring off into the distance. “She died years ago.”
