Chapter 7 - THE CLIENTS
The compromised staging file came from three banking clients.
Not all six.
Approximately:
2,140 loan records.
Most fields were tokenized.
But 317 records contained text notes with personally identifiable information.
Some included:
borrower names,
guarantor names,
commercial addresses,
litigation notes,
and partial tax identifiers.
No full Social Security numbers.
No full bank account numbers.
Still sensitive.
Morgan Systems had contractual duties to notify the banks of certain unauthorized disclosures.
Did sending data to Vertex count as an unauthorized disclosure if Vertex never opened the file?
Possibly.
Grace said:
“We notify based on access and contract language, not on what feels fair.”
Ethan wanted to wait.
“Vertex quarantined it.”
Grace answered:
“That may reduce harm. It does not erase transmission.”
The first bank’s chief risk officer was furious.
“You let real client records sit in a founder’s home-office package?”
Ethan said:
“It was staging data.”
“That’s not an answer.”
The second bank demanded a full forensic review.
The third suspended new ATLAS pilots.
Claire listened from another room to part of the first call.
She had wanted Ethan humiliated.
She had not imagined:
bank lawyers,
compliance officers,
borrower records,
and notification clauses.
Her revenge had acquired strangers.
The banks reacted differently because their contracts were different.
Stonebrook Bank required notification within twenty-four hours of any unauthorized transmission, regardless of confirmed access.
North Valley Commercial Bank required notice only if protected information was reasonably believed to have been accessed by an unauthorized person.
Harbor Municipal Credit required notice of any event likely to materially affect confidentiality.
Morgan Systems therefore could not send one generic letter.
Each client needed a separate legal analysis.
Ethan hated the fragmentation.
Grace said:
“This is why data contracts matter before something goes wrong.”
May you like
One incident had become three different obligations.
Claire had never imagined that pressing Send could create different legal realities for different recipients of the same underlying service.
