What if he thought he’d fixed the problem but he was wrong?
Chewing a nail, she glanced at the day-shift operator, Carmen. If someone at the company was using her reports to break into their clients’ systems, she had just put the country’s national security at risk. There were about a dozen people at Aggressor with the skills to access her reports without permission.
What didn’t fit was the timeline on some of the malicious attacks. Weeks or months had gone by in several cases. With that much lag time, none of the companies should have been vulnerable.
She stuck a half dozen Skittles in her mouth and sat up, suddenly energized. What if someone was tampering with the client reports, taking out a key vulnerability to leave themselves a backdoor?
For the next two hours, she compared the copies of the reports she kept on her personal drive with those she’d uploaded to the network. Nothing. She reached for more candy, only to find the bag empty, and slumped in defeat. If clients weren’t getting the wrong report, then why weren’t they making the changes to protect themselves, especially after spending the money to have Aggressor find the holes?
Not wanting to bother Duncan until she had more to go on, she dialed the office of the CIO at P + F whose name was at the top of her report.
“Marjorie Wilson,” the woman answered, her voice brusque.
Valerie hesitated. “Ms. Wilson. I didn’t expect to get you directly.”
“My secretary called in sick and the temp agency hasn’t sent a replacement. Who is this?”
“Sorry, I’m Valerie Sanchez. I work at Aggressor International.”
“I’m not interested.” Her voice faded as if she were distancing herself from the phone.
“No, wait. I’m not selling anything.”
Ms. Wilson sighed.
“I saw recently that your print servers had been hacked and—”
“Where did you hear that?” The question came like a slap.
“On a forum for hackers and network admins, ma’am. I’m following up because I know I pointed out that vulnerability in my report to you last year and—”
“What the hell are you talking about?” The CIO was vibrating with anger now. “What report?”
“The pen test report I wrote for you in October of last year.”
“I don’t read unsolicited materials, but if you hacked our system to prove something…”
Valerie wanted to beat her head against her desk. “Ma’am, your company hired us to provide a penetration test, and I’m the one who wrote the report. It would have come from Duncan Hollowell, after your teleconference with him.”
“I don’t know what you think you’re up to, but we never hired anyone, and this conversation is done.”
What the hell? Valerie sat with the phone to her ear for a beat and then replaced the receiver, her hand shaking.
If Marjorie Wilson was telling the truth, then it wasn’t someone at Aggressor taking advantage of early information. There was only one man who made the assignments and coordinated with the clients: Duncan. If the clients weren’t real…
Oh shit. Valerie doubled over and wrapped her arms around her stomach to stem the tide of nausea.
How could he?
She rested her forehead on the cool Formica desktop and tried to sort through her muddled thoughts. Was she overreacting? Maybe there was a misunderstanding.
Shoving the empty candy wrapper into the trash—and now regretting having eaten so much sugar this early in the day—she brought up another report and called another client from a couple months ago who had been recently hacked. This time she used a slightly different approach.
“Hi, Tom,” she said after they made introductions. “We’re surveying our past customers on their experience, trying to determine how we can provide better service. Would you be willing to answer a couple of questions?”
“I think you have us on your list by mistake,” he said genially. “We’ve never used Aggressor.”
Her stomach backed up into her throat. “Oh, I’m so sorry. We might have some cross- contamination from the prospective client database. Sorry to bother you.”
