Boss Publicly Accused Me of Data Theft and the Server Logs Exposed Him

Boss Publicly Accused Me of Data Theft and the Server Logs Exposed Him

I stood up from my chair.

Not to defend myself. I had learned a long time ago that defending yourself in front of a crowd only makes you look defensive. I stood because I wanted Derek to be looking at me when I said the next thing.

“Derek, before HR joins this call, I want to give you one chance to stop talking.”

That was all.

He laughed. An actual laugh, turned out toward the room, looking for allies. A few people shifted in their chairs. Nobody laughed with him.

“Claire,” he said, in the particular tone he reserved for dismissing me in meetings, “we have the logs. We have the drive. I think you should step outside and wait for HR.”

I reached into my bag.

I pulled out my phone.

I called Marcus Webb.

He answered on the second ring. I put him on speaker and set the phone on the table in front of me.

“Marcus, this is Claire Morrison. I’m in the thirty-second floor conference room at Meridian Group. My employer is in the process of publicly accusing me of data theft. I’d like you to speak with him.”

Silence.

Derek’s face did something I had never seen it do before. The confidence moved somewhere else and something else came in to replace it.

Marcus Webb has a very calm voice. The kind of calm that comes from twenty-two years of employment law litigation in the Northern District of Illinois. He introduced himself. He named the firm. He said, clearly and without theater, that he had in his possession a documented record of eighteen months of intellectual property misappropriation, credit theft, and targeted workplace suppression against his client, Claire Morrison, and that he was prepared to file in federal court by end of business that day if the meeting did not conclude immediately.

Then he said something else.

He said the server logs Derek had just referenced were not going to show what Derek believed they would show. Because Marcus had spent the previous afternoon with a forensic IT specialist named Joel Reyes, who had already pulled the actual access metadata from Meridian’s own server backup.

The data showed that the files Derek claimed I had stolen had been accessed, copied, and forwarded using Derek’s own credentials. His login. His timestamps. His IP address, resolving to the executive suite on the thirty-third floor, not my workstation on thirty-two.

Marcus stated it plainly.

“The drive your client is currently holding as evidence was loaded from the thirty-third floor executive terminal at 11:14 p.m. on January 14th. Ms. Morrison was not in the building at 11:14 p.m. on January 14th. Her building key card shows she exited at 6:08 p.m. and did not return. Mr. Holt’s key card shows he accessed the executive suite at 10:52 p.m. and exited at 11:41 p.m.”

The ventilation system hummed overhead. That was the only sound in the room.

Derek had not moved. The manila folder was still in his hand. He looked like a man who had just been told the bridge he was standing on had been removed from underneath him some time ago and he was only now noticing the air.

A senior partner named Gerald Okafor, a man I had exchanged maybe thirty words with in four years, stood up slowly from the far end of the table. He looked at Derek for a long moment. He did not say anything to Derek at all.

He looked at me.

“Claire,” he said, “please stay. Everyone else, the meeting is over.”

People filed out fast. The room emptied in under ninety seconds.

Gerald walked me to the thirty-third floor himself. He sat me down in a conference room that faced the Chicago River and brought me a cup of coffee. He sat across from me and, in the careful measured language executives use when they are also calculating exposure, told me that Meridian Group took this situation with the utmost seriousness and that I should expect a full accounting.

I told him I expected exactly that.

Marcus Webb arrived at 4:15 p.m. He brought Joel Reyes and a printed summary of the forensic findings. We spent two hours in that room going through every file.

Derek Holt was placed on immediate administrative leave at 5:30 p.m.

He was terminated for cause the following Tuesday, January 21st, after Meridian’s own internal investigation corroborated every finding in Marcus’s report. The credential trail. The copied proposal decks going back twenty-two months. The email chains to clients where my name had been stripped out. The IP logs placing him at that terminal at 11:14 on a Tuesday night.

All of it.

I found out later from Brianna — who is, incidentally, the most underestimated person at that company — that Derek had attempted the same setup three years earlier with a junior analyst named Thomas Park, who had left the firm quietly and relocated to Denver. Marcus reached out to Thomas. Thomas had kept his own documentation.

That became a separate filing.

In March, Meridian Group reached a settlement with me. I am not permitted to disclose the amount. I will say that I purchased a condominium in Lincoln Park in April and I have a window seat in every room.

In that same month, Derek Holt’s professional credentials with the American Marketing Association were suspended pending investigation.

As of May, he had not found new employment at any firm in Chicago. That was not something I arranged. That is simply what happens when thirty-seven witnesses, one forensic IT specialist, one twenty-two-year employment litigator, and the HR records of two separate companies all confirm the same sequence of events.

I still work in marketing.

I am a senior director now. My office is on the east side of the building, window facing the lake.

The water is extraordinary in the mornings. Clear all the way to the Indiana shoreline.

I come in every day at 6:47.

Old habits.

Related Posts