Chapter 5
The final forensic accounting report took eleven months.
Gross suspicious payroll and transition payments:
$1.41 million.
That number was higher than the first review because two other households found similar accounts.
Then the auditors removed legitimate transactions that had initially looked suspicious.
Actual fraudulent payments:
$1.09 million.
Then prior covert repayments and vendor credits:
$168,000.
Funds frozen or recovered before loss:
$224,000.
Insurance and bank reimbursements:
Separate.
Net economic loss to household clients before settlement:
About $698,000.
Still large.
But not the first headline.
Then restitution.
Grant and Angela could not repay everything personally.
Sterling entities contributed through civil settlement.
Insurers paid covered portions.
Charles Sterling’s supervised equity sale funded part.
Banks refunded specific losses tied to verification failures.
No magical full recovery overnight.
Then former employees whose identities were used received separate compensation for identity restoration, time, and documented harm.
Theresa Bell had spent weeks correcting tax records.
Omar Jenkins had been denied a car loan because a fraud account appeared in verification data.
Luis Peña had no direct credit damage but still had his identity used.
Different damages.
Different settlements.
Then my case.
The $84,600 transfer had been fully recovered before leaving the two banks.
Good.
That did not erase abduction.
My civil case separated economic identity harm from physical and emotional harm.
Medical costs.
Lost wages.
Independent counsel.
Therapy.
Pain.
No NDA.
No forced resignation.
Then Roman’s household settled its own responsibility.
Why?
Personnel data had been over-shared and under-controlled.
Management failed to protect me after visible injury.
A partner’s informal influence over staffing had been allowed to grow.
The estate did not claim:
Evelyn acted alone, therefore we owe nothing.
That mattered.
Then my weekly privacy work expanded.
I helped map vendor data.
Not access to everyone’s secrets.
Metadata.
Which vendor receives what.
Why.
For how long.
Then we found absurd things.
A florist had staff mobile numbers from a gala two years earlier.
Why?
Delivery coordination.
Still saved.
Delete.
A travel agency had copies of two former employees’ passport pages.
Contract ended.
Delete.
A relocation firm had Caleb’s name because he was listed as my dependent during an apartment move.
That made me furious.
Not because they misused it.
Because I had forgotten I ever provided it.
They had no current need.
Deleted.
Then I learned deletion must be verified.
Vendor saying “done” was not enough for sensitive datasets.
Contract required certification.
For high-risk vendors, audit rights.
Then someone proposed never sharing IDs with vendors again.
Impossible.
Some travel, background, housing, and regulated services need identity data.
The better principle:
Minimum necessary.
Purpose-limited.
Time-limited.
That was less emotionally satisfying than “never.”
More workable.
Then Sterling’s successor company applied to remain an approved logistics vendor after new ownership.
I wanted to say no forever.
Procurement reviewed.
New management.
No Grant.
No Sterling family control.
Independent audit.
Strong data controls.
Still, trust had to be rebuilt.
The company received a limited, low-risk contract first.
No personnel data.
Furniture only.
Performance good.
A year later, scope expanded carefully.
Accountability without permanent contamination.
I needed time to accept that.
Then one of the former employees, Theresa Bell, disagreed.
She said:
“I would never use them again.”
Fair.
Her choice.
Institutions can choose differently after review.
No one had to share my conclusion.
Then the warehouse property.
Roman’s port company repaired it after the lease ended.
Could have demolished.
Engineering said structure sound.
New tenant wanted marine equipment storage.
So:
Lighting.
Shelving.
Doors.
Safety.
No memorial.
The concrete floor where I crawled was pressure-washed.
That bothered me when I heard.
Then I asked myself why.
Did I want the blood stain preserved?
No.
Then wash it.
Buildings do not owe trauma permanence.
Then Caleb turned ten.
Birthday at a bowling alley.
Roman sent nothing extravagant.
Good.
The household did not insert itself into Caleb’s birthday.
His life remained separate.
He did ask once whether Roman was “the guy who found you.”
“Yes.”
“Is he a superhero?”
“No.”
“He has security men.”
“That is not the same thing.”
He laughed.
Then asked if superheroes have payroll departments.
Probably.
Then my job changed.
Housemaid to housekeeping records liaison.
Not a promotion exactly.
Split role.
Three days housekeeping.
Two days operations privacy.
I applied when Helena posted it.
Other candidates.
Interview.
I got it.
Why?
Housekeeping experience plus training plus demonstrated accuracy.
Not because Roman rescued me.
Then I made my first mistake.
I deleted a vendor contact list that was still needed for an active event.
Not sensitive IDs.
Just phone numbers.
Recoverable from backup.
Embarrassing.
My manager Priya Desai said:
“Privacy is not deleting faster.”
Then:
“It is retaining deliberately.”
I wrote that down.
Then another mistake.
I restricted access to a housekeeper schedule because it contained home addresses.
The current schedule did not contain addresses.
I had assumed.
Operations lost two hours.
Corrected.
Again.
Trauma had made me see personnel data everywhere.
Training made me look instead of assume.
Then one actual issue.
A staffing agency asked for complete personnel profiles for background rechecks.
Why complete?
They needed name, date of birth, authorization, and ID verification—not emergency contacts, dependents, prior discipline, or bank data.
Request narrowed.
That felt like winning.
Not dramatic.
No warehouse.
Just fewer unnecessary fields leaving the house.
Then my black-SUV fear faded.
Not gone.
One day the new warehouse tenant sent a black delivery SUV to the estate.
I saw it.
Heart jumped.
Then settled.
The vehicle parked.
A driver unloaded boxes.
Nothing happened.
Ordinary repetition did what speeches could not.
The settlement process also forced every affected employer to answer one uncomfortable question:
Why were former employees never notified when their payroll profiles were reactivated?
Because the systems treated reactivation as an internal administrative event.
That changed.
Any reactivation of a terminated profile triggered notice to the former employee through a last-known verified channel when legally appropriate.
If the address bounced?
Manual review.
Then one legitimate pension correction reactivated a former gardener’s profile.
He received notice.
Called HR.
Confirmed.
Payment processed.
No problem.
Then a fake attempt six months later at another household triggered the same alert.
Former employee said:
“I did not request anything.”
Stopped before payment.
Controls spread beyond the scandal.
Then my team built a principle around dormant records.
Dormant does not mean harmless.
A profile with banking, ID, and tax data can be valuable long after employment ends.
So archived profiles became read-only.
Reactivation required elevated approval.
No casual “turn it back on.”
Then one manager complained because it slowed rehiring seasonal workers.
We created a separate rehire workflow.
Reuse verified data where allowed.
Fresh consent where needed.
Not full manual rebuild.
Security and usability both matter.
Then I learned another lesson from former employees.
Some did not want contact from the Calder estate at all.
They had left badly.
So remediation outreach came through independent counsel where possible.
No requirement to re-enter an old workplace relationship to fix identity harm.
That was respectful.
Then Caleb saw me filling out a credit-freeze form.
“Are we poor?”
“No.”
“Then why are you worried about credit?”
I explained badly.
He listened.
Then:
“So someone can borrow your name?”
“Yes.”
“That’s stupid.”
Accurate.
Then he asked whether someone could borrow his.
I froze.
His data had been in relocation records.
We checked.
No evidence of misuse.
Placed minor credit freeze because he was a child and did not need credit.
That gave me some peace.
But I refused to turn his childhood into permanent fear.
We did the sensible step.
Then went for ice cream.
The former-employee outreach also revealed a problem with old emergency contacts.
Some letters went to spouses from relationships that had ended years earlier.
No sensitive fraud details were disclosed in those first contacts, luckily, but the process was clumsy.
So former-worker outreach used last verified direct contact where possible and independent tracing services under privacy limits where necessary.
No calling relatives casually.
Then one former driver had died two years earlier.
His identity had still been used in a fake account before his death.
Who handled remediation?
His estate representative.
No sensational “dead employee stealing money” headline.
The records were corrected.
His widow received support resolving a tax notice.
That case reinforced a principle: identity records outlive employment, and sometimes people.
Controls have to recognize that without keeping everything forever.
Then my coordinator role exposed another blind spot.
We had tightened external vendor access but left too many internal employees with broad personnel permissions.
Why?
Convenience.
Payroll, HR, operations, travel, and security each had inherited access from old roles.
We ran a role-based review.
Some lost access.
No one had misused it.
That was still success.
Security is not only catching bad actors.
It is removing unnecessary opportunity before someone becomes one.
The identity-restoration program also created a small but important appeals process.
If a former employee disagreed with the employer’s reconstruction of what data had been exposed, an independent reviewer could check the file.
Why?
Because the employer that failed to protect the data should not be the only voice deciding the scope of harm.
One former worker insisted her bank account number had been exposed too.
Initial review said no.
Independent review found an old payroll export that had, in fact, included it.
The notice was corrected.
Support expanded.
That built more trust than pretending the first answer had to be right.
Then one case went the other way.
A former driver believed his medical information had been shared with Sterling.
No evidence.
Only a work restriction note had been provided.
The reviewer explained the difference.
He still disliked it.
May you like
Fair.
Accuracy does not guarantee comfort.
