The Day My Account Got Hacked (And My School Got Held Hostage)

Javi’s fingers were still tingling from three straight hours of *Star Rift: Embers* ranked matches when the notification popped up on his phone, the blue glow cutting through the dim light of his bedroom. He’d just pulled off a 1v5 clutch to push his global rank into the top 1% for the first time ever, his guild Spectre’s Edge spamming the Discord chat with emojis and hype. The email subject line looked exactly like the official *Star Rift* support alerts he’d gotten before: *Action Required: Unusual Login Detected on Your Account*. He tapped it without a second thought, the link loading a page that was identical to the real login portal, right down to the neon game logo in the corner. The only difference was the domain: *starriver-verify.com*, one extra “r” he didn’t notice until after he’d typed in his password, then the six-digit code from his Google Authenticator, prompted by the fake page’s “Verify your identity to lock your account” warning.

By the time his game client logged him out, the email inbox was already flooded with alerts: *Your account has been permanently suspended for violating terms of service.* His heart slammed into his throat as he fumbled to pull up the support page, typing in his appeal as fast as his thumbs could move. The automated response popped up 10 minutes later: *Appeals take 72 hours to process. All virtual assets are forfeited in cases of confirmed unauthorized access.*

The Neon Spectre skin he’d spent eight months grinding for, the guild leadership permissions he’d earned by carrying his team through every weekly raid, the 200+ in-game friends he’d made over two years of playing—all gone. He slammed his phone down on his desk so hard the screen cracked, the spiderweb fracture spreading across the *Star Rift* wallpaper he’d paid five dollars for on Etsy. His mom’s voice drifted up the stairs ten minutes later, calling him for dinner, but he didn’t answer, just curled up on his bed staring at the ceiling, the Discord chat on his laptop still blowing up with people asking where he’d gone.

He spent the next three days doomscrolling cybersecurity TikTok videos, half out of rage, half out of a desperate need to understand how this had happened. The videos explained the trick clearly: it was a phishing attack, a fake login page designed to steal credentials, the domain just different enough to fool a casual glance. He reported the fake site to *Star Rift*’s support team, but the response he got three days later was cold: *The account has already been transferred to a new owner. We cannot reverse asset transfers for compromised accounts.* The guild disbanded a week later, its members drifting off to other servers, and Javi still hadn’t logged back into Discord. He’d deleted the app off his phone, too tired to deal with the messages asking where he’d been.

Friday morning, he dragged himself out of bed, his eyes still puffy from three days of interrupted sleep, and trudged to school half asleep, his *Star Rift* hoodie pulled up over his head. The red notice taped to the front entrance stopped him cold: *Notice: Student Portal System Maintenance. All Exams Cancelled for Two Weeks.* He’d never seen a maintenance window last longer than 24 hours, not in his three years at Westbrook High. By the time he got to his locker, the rumor was already spreading through the hallway like wildfire: the school’s student portal had been hit with a ransomware attack. All student data—grades, college application materials, social security numbers, even cafeteria meal balances—had been encrypted, locked behind a digital deadbolt. The attackers were demanding five bitcoin, roughly $150,000 at current rates, or they’d publish every student’s personal information publicly.

Javi’s blood ran cold. He’d uploaded his Common App supplemental materials to the portal two days prior, and he was the treasurer of the anime club, with $3,200 in unspent event funding tied up in the portal’s budget system. If that data was deleted or leaked, he’d be on the hook for the money, and his college applications would be set back months. He fumbled for his phone to pull up the portal, and the red skull icon popped up on the screen before he even finished typing his password: *Your data is encrypted. Send 5 BTC to [wallet address] within 72 hours, or we will publish all student data publicly.*

“Dude, you okay?” Kai’s voice made him jump. His best friend was standing next to his locker, face ashen, his hands shaking as he clutched his backpack strap. Kai was a transfer student from Mexico, his parents undocumented, and he’d uploaded his family’s immigration paperwork to the portal the week before as part of a college program for first-gen students. “If those papers get leaked…” He didn’t finish the sentence, but Javi knew what he meant: ICE could find his parents, and they’d be deported.

“I know someone who can help,” Javi said without thinking, the words out of his mouth before he could second-guess them. He’d heard Manny, the owner of the local makerspace and his old middle school robotics coach, mention a retired ethical hacker who volunteered there teaching kids cybersecurity, but he’d always written it off as the kind of weird tech stuff Manny was into. Now he didn’t have a choice.

The makerspace was in a converted warehouse three blocks from the school, the front door propped open even in the cool October air, the hum of 3D printers and the smell of burnt solder drifting out onto the sidewalk. Manny was behind the front counter fixing a broken remote control car for a kid who’d come in for after-school robotics, and he looked up in surprise when Javi walked in, Kai trailing behind him. “Javi? I haven’t seen you in here since middle school. You finally decided to stop playing video games long enough to build something?”

“Manny, my school got hacked. I need to talk to that hacker you told me about, the retired one.” Manny’s smile faded, and he nodded toward the back workbench, where a woman in a frayed gray hoodie was hunched over a Raspberry Pi, a half-empty soda can and a pile of cat treats next to her. Three cats were curled up on the workbench next to her: an orange tabby, a black cat, and a calico with one torn ear, all of them half asleep. She looked up when they approached, her graying hair pulled back in a messy bun, a soldering iron still in her hand, and Javi’s first thought was that she looked nothing like the hooded, shadowy hackers he’d seen in movies. She looked like a retired art teacher, or the kind of lady who ran the library’s book club.

“This is Lila,” Manny said. “She spent 30 years as a cybersecurity consultant for IBM, found vulnerabilities in state election systems that got her a commendation from the FBI, and now she spends her retirement teaching kids how not to get hacked. Don’t let the cat hair fool you—she once took down a ransomware gang that was targeting hospitals in the Midwest.”

Lila set down the soldering iron and wiped her hands on her jeans, nodding at Javi and Kai. “Sit. Tell me what happened.” Javi explained everything, his voice cracking a little when he talked about the guild, then Kai’s immigration paperwork, the school’s portal locked down. When he finished, Lila didn’t make a joke, didn’t tell him it would be okay, just pulled a sheet of notebook paper over and drew a chain of five links, labeling each