I Reset One Password at 2 a.m. and Cost My Company 4.1 Million Dollars

The phone rang at 2:14 a.m. and I almost let it go.

I was standing in the break room on the fourth floor of Brightline Freight, eating orange cheese crackers from the vending machine and calling it dinner.

Forty-one tickets sat in the queue. Most were people locked out of their accounts, which is what the night shift in Kansas City is mostly made of. Nobody calls a help desk at that hour unless they are tired, late, or both.

I picked up on the fifth ring. Brightline IT, how can I help?

The man said his name was Dale Whitcomb, from the Omaha office. I’m locked out and I’ve got a manifest due at dispatch by six, he said.

He sounded like me. Worn out, a little hoarse, with an airport announcement going off behind him about a gate change to Denver. He said his flight was cancelled and his phone was in a checked bag. The phone was what gave him the sign-in code.

The rule was simple. No code, no reset, unless a supervisor signs off. My supervisor, Gary Pruitt, was asleep in Overland Park with his phone on silent. Everybody on nights knew that.

I can try your employee number and your manager’s name, I said.

He had both in two seconds. He laughed and said his manager was a nightmare. I laughed too. It was 2:31 in the morning and someone was being nice to me.

I reset the password. In the ticket I typed “Verified by ID. User traveling.” Then I went back to my crackers and a woman in Wichita who could not find her Caps Lock key. Three minutes, maybe four. I forgot about it by breakfast.

Three weeks later, on a Monday, every screen in the building went red.

Dispatchers stood around holding printed paper like they had never seen it before. Trucks sat at the docks along I-35 with the engines running, and drivers posted videos in Facebook groups. Brightline moved groceries across eleven states, and for eleven days it moved almost nothing.

Some stores in Tulsa ran short of milk. My cousin sent me a photo of an empty bread aisle in Wichita with the caption thanks for your service.

The first people through the door were from the FBI. Then came two from the Treasury Department, one from the Cybersecurity and Infrastructure Security Agency, a man from the State Department whose lanyard had no name on it, and a lawyer from the insurance company who billed in six-minute chunks.

They took over the fourth-floor conference room and left a Hy-Vee sandwich platter untouched for two days.

Special Agent Tanya Brooks ran the room. She wore running shoes with a blazer and drank black coffee from a Royals mug she had found in a cabinet. She told us the group behind it was called Red Heron. She said it flat, the way you would read out a bus timetable.

We know all seven of their names, she said. We know the building they work from and the café where they eat lunch. A federal grand jury has indicted every one of them.

Then you arrest them, said Howard Lindqvist, our CEO.

Tanya Brooks shook her head slowly. Their government says they are civil servants doing official work. There is a letter, and it has a stamp on it. She tapped the table once. Arrest one in a third country and it becomes a diplomatic incident. Nobody above my pay grade wants that over a freight company.

Howard Lindqvist said nothing. It was the first time I had ever seen him do that.

On day six, the insurer paid 4.1 million dollars in cryptocurrency, after the lawyers agreed it was not technically illegal. The keys came back with a short note. It thanked us for our prompt cooperation and suggested we turn on two-step sign-in everywhere. I read it twice, standing next to the printer, waiting for the joke. There was no joke.

Afterward, Howard Lindqvist sent an email with the word resilience in it four times. The stock dropped nine percent. Sixty-two people in billing were let go and the company called it “restructuring.” The executive bonuses went out on schedule.

A consulting firm charged seven hundred dollars an hour to tell us we had a “friction culture,” and then we all had to watch a thirty-eight-minute training video starring a cartoon fox named Phil.

On day nine, Tanya Brooks asked me to come to the conference room. Gary Pruitt was already sitting against the wall, the colour of the paper in front of him. She slid a printed page across the table and put her finger on one line.

2:31 a.m. Omaha. Password reset.

The real Dale Whitcomb was asleep in his own bed that night, she said. He has never been to Denver.

My mouth went dry. There was a plant in the corner with a dead leaf on it, and I looked at that leaf for a long time.

Do you remember this call? she asked.

Here is the part I still turn over at night. I could have said yes. It would have taken one word. Instead I said, Night shift is a lot of calls.

Every word of that was true. Gary Pruitt looked at the table. Tanya Brooks waited long enough that the air conditioning started to sound loud.

The ticket says verified by ID, she said.

Then that is what I did, I said.

She wrote something down. She did not ask again.

The final report used the phrase “a social engineering attack exploiting a standard credentialed process.” It named no person. Gary Pruitt told everyone the night desk had followed procedure, which was almost right if you did not look at the supervisor part.

Six weeks later he was promoted to director, and I was made team lead. The raise took me from 23.40 an hour to a salary of 61,000. It was the first time in my life I had been paid to be tired in daylight.

My mother cooked on Sunday at her house in Raytown, and she made too much, the way she does when she is worried. She asked if I was sleeping. She called me Marisol, my whole name, which she only does when something is wrong.

I told her about the raise and she put her hand over her mouth and said a prayer in the kitchen. I ate two helpings of her rice and did not say anything else.

I wrote the new reset policy myself. Two supervisors, a video call, a photo of the badge, no exceptions, not even for the CEO. Everyone says it is the best thing to come out of the whole mess. Gary Pruitt put it in a slide with my name on it.

Last week Tanya Brooks texted me, out of nowhere. Two more names added to the indictment. Same café. Same lunch. The group’s website had put up a new post about “responsible disclosure,” complete with a logo.

I am at my desk now, on the fourth floor, with a bag of cheese crackers in the drawer. Ticket 88213 is still in the system, in my words, untouched. I have it open on the screen. The cursor is blinking right after the word traveling.

Some people are protected by a government, and the rest of us are protected by whoever stops reading the log.