Chapter 8 - SOMEONE PIGGYBACKED ON THE PLAN
Rebecca gave the forensic firm full access to her laptop.
Not because she suddenly became noble.
Because her lawyer told her not doing so would look worse.
The timeline became clearer.
8:31 — Removal petition filed.
8:47 — Daniel added to Noah's school pickup profile through Carter Family Office delegated account.
9:08 — Elliot calls the fake Claire number.
9:12 — Unknown woman calls Elliot back and directs him to Westbridge.
11:42 — Rebecca accesses old family messaging account.
11:46 — Rebecca drafts fake Noah message.
11:49 — Message sent to Daniel.
3:10 — Daniel arrives.
3:15 — Elliot arrives.
Rebecca had used a plan already in motion without knowing it.
That was almost more disturbing.
“Who knew you were going to send Daniel there?”
I asked.
Rebecca thought.
“My attorney.”
“Name?”
“Laura Keene.”
“Anyone else?”
“My chief of staff knew I wanted current boundary evidence.”
Daniel looked disgusted.
“That's a sentence.”
Rebecca ignored him.
“Neither knew I planned to spoof Noah.”
Good.
Her manipulation was her own.
Then the analyst checked Bluebird file access.
The phrase used in Daniel's message—
Mom won't tell me what Dad meant by Bluebird
—came almost word for word from one of Andrew's old drafts.
Who had opened that draft recently?
Rebecca.
And one external user.
CRESTLINE-17
Daniel frowned.
“Crestline.”
Rebecca looked worse.
Crestline Advisory handled due diligence for Northstar Capital.
The buyer.
“They have data-room access.”
Daniel said.
“Not to family messages.”
“They shouldn't.”
The old Bluebird folder had been copied into the sale data room by mistake.
A junior finance employee had uploaded an archive batch including estate material.
Crestline had downloaded it six weeks earlier.
That did not prove a Crestline employee manipulated anything.
It proved outsiders had access to the phrase.
Then school IT identified the source of the 8:47 change.
Same Carter delegated login.
Network origin:
A VPN belonging to Crestline Advisory.
Rebecca stared.
“They accessed Noah's school profile?”
Not directly.
The delegated Carter portal connected several family services.
Tuition.
Insurance.
School.
Old architecture.
Bad segmentation.
Crestline should never have had the login token.
How did they get it?
The sale data room contained an old onboarding spreadsheet.
One column with a legacy single-sign-on recovery code.
Someone had uploaded credentials into a buyer data room.
Not a conspiracy.
Terrible controls.
Daniel rubbed his face.
“So an external diligence vendor had the ability to alter a child's school contact list.”
The forensic analyst answered:
“For approximately eleven days.”
Everyone went silent.
Rebecca asked:
“Who used the Crestline account?”
“One assigned consultant.”
Name:
Peter Sloan.
Forty-one.
Senior diligence contractor.
No family relation.
No reason yet to care about Noah.
Crestline suspended his access immediately.
Peter denied changing anything.
His account was shared with two analysts during a deadline crunch.
Another bad practice.
We now had a family scheme—
Rebecca's—
May you like
inside a separate access breach we did not understand.
And somebody had used both to bring the same people to the same school.
