Before the Last Number

I have told this story three times now — once to the police, once to a journalist who never published it, and once to myself, alone in a hotel room in Oslo with the curtains drawn at noon. Each time I tell it, the details sharpen in ways that frighten me. Not because the facts change, but because I understand more about who I was when it happened, and I am not sure I like what I find.
It began on a Tuesday in late November, in the kind of cold that settles into the bones of a city and refuses to leave. The city was Bergen — Norwegian winter, the harbor gray and patient, the old wooden houses along Bryggen pressing together like people trying to keep warm. The five of us had been working together for eleven months on a fraud investigation involving a mid-sized shipping logistics company whose accounts had begun to tell a story that their executives insisted was not there. Liv Granli was our lead analyst, the kind of person who could look at a spreadsheet and feel something wrong in it before she could articulate why. Bilal Haddad was the compliance attorney, meticulous and quietly funny, the one who made the long hours bearable. Riku Xu had come in from the financial crimes unit in Stockholm, on loan to us for the final phase of document review. Sten Pedersen was our senior investigator, twenty-two years in the field, the kind of man who had seen enough to stop being surprised by anything. And then there was me — the coordinator, the one who kept the timelines and managed the communication threads and made sure the right documents reached the right people. I was good at my job. I was also, I would later understand, very good at not asking certain questions.
The countdown appeared on a Monday. Riku noticed it first, which made sense — he was the one who spent the most time in the secure document portal we used to share case files. It was a small thing, at first. A timer in the upper right corner of the portal’s dashboard, white digits against the dark gray interface, counting down from ninety-six hours. None of us had put it there. The system administrator for the portal was a contractor based in Copenhagen, a man named Torben who had set up the platform eighteen months earlier and whom none of us had spoken to in half a year. Sten called him immediately. Torben said he had not touched the system. He said the timer was not a feature of the platform. He said he would look into it and call back. He did not call back that day.
We kept working. That is the thing I want to be honest about — we kept working, because the timer felt like a technical glitch, and because we were close, and because Liv had just found a secondary ledger buried in a folder of scanned shipping manifests that suggested the money had not gone where the executives claimed. The excitement of that discovery made the timer feel small. Bilal printed a screenshot of it and pinned it to the corkboard in the corner of the room with a note that said ‘ask IT’ in blue pen, and then we moved on. Ninety-six hours felt like plenty of time to get an answer.
By Wednesday morning, it had reached sixty-one hours and we still had no explanation. Torben had sent a brief email saying the code appeared to have been inserted externally, that he was escalating it, and that we should consider changing our access credentials. We changed our passwords. The timer did not stop. Sten contacted the company’s internal security team, who said they had no knowledge of any scheduled system event. Riku ran a quiet search on the portal’s activity logs and found that the code insertion had come from an IP address registered to a data center in Riga. None of us had any connection to Riga. The investigation had no documented link to Latvia at all. But the company we were investigating moved a significant volume of freight through Baltic ports, and that fact settled into the room and stayed there.

0 likes

About the Author

Marcus Rennford — a former investigator who reads a crime scene the way most people read a room. Where something for you is trash or dirt, for him is new clue.

— Marcus Rennford

Full author profile

August 12, 2026

10min-stories