The MAC Address
April 15, 2026 // Themeword: Residue
The alert came in at 2:14 AM. An unrecognized device on the internal network, subnet 10.0.4.0/24 — the one reserved for the building's physical infrastructure. Cameras, badge readers, HVAC controllers. Nothing that should be unknown.
Nadia pulled the MAC address: A4:83:E7:22:01:FC. She ran it through the vendor lookup. Apple. An iPhone, most likely.
"Nobody should have a phone on that subnet," she said, though nobody was in the office. It was Tuesday night. She was the only person on the security rotation because Priya had called in sick and the backup — some contractor named Jules — hadn't been given VPN credentials yet. She'd filed the ticket three days ago. IT hadn't responded.
She traced the device's traffic. Mostly DNS queries. A few NTP calls. One HTTPS connection to weather.com. The device was barely doing anything. It was just... there. Connected. Present.
The next morning she pulled the DHCP logs. The device had first appeared on the network forty-one days ago. It connected every night between 11 PM and 4 AM, then vanished. Always the same IP lease: 10.0.4.247. Always the same MAC.
Forty-one days.
She leaned back in her chair and stared at the ceiling tile that had a brown water stain shaped like France. Forty-one days of someone — or something — sitting on the infrastructure subnet, checking the weather.
"Hey." Marcus from Facilities was in the doorway, holding a coffee mug that said WORLD'S MOST ADEQUATE. "You looking into that weird device thing?"
"You know about it?"
"Kinda." He sat down without being invited, which was a Marcus thing. "So, Benny — you know Benny? Night janitor? Older guy, always wears that green jacket?"
"I know Benny."
"Right. So Benny's been using the break room on three to watch YouTube after his shift. Been doing it for years, actually. But six weeks ago his phone stopped connecting to the guest WiFi. Turns out someone rotated the password and didn't tell Facilities. Benny doesn't have a computer, doesn't have the portal credentials to look it up. So he tried the other network he knew about — the one the maintenance crew used to use before the Meridian acquisition."
Nadia closed her eyes.
"He had the password from before the buyout," she said.
"Still works, apparently."
"The infrastructure VLAN isn't even supposed to have WiFi access."
"Yeah, well." Marcus shrugged. "There's an old access point behind the server rack on three. Nobody decommissioned it. Benny's phone auto-connected because it remembered the SSID from two years ago."
Nadia sat with this for a while after Marcus left. She could write it up as a security incident. It technically was one — unauthorized device on a restricted subnet, credential reuse from a pre-acquisition environment, an untracked access point that should have been decommissioned during the merger integration eighteen months ago.
She could write the report. She could flag Benny's phone, revoke the old credentials, rip out the access point. It would be correct. It would be thorough. It would close the ticket.
But she kept thinking about Benny sitting in the break room at midnight, watching videos on his phone with one earbud in, the building quiet around him, the cleaning cart parked by the elevator. Forty-one nights of him not knowing he was a security incident. Forty-one nights of his phone just doing what phones do — connecting to whatever network it remembers, checking the weather, syncing the clock.
The vulnerability wasn't Benny. It was the residue. The old password that still worked. The access point no one remembered. The merger that moved people and assets but forgot to move the invisible infrastructure — the permissions, the handshakes, the trust relationships that persist long after the organizational chart changes.
She opened a new ticket. Not an incident report. A remediation request. Decommission legacy AP on floor 3. Rotate infrastructure VLAN credentials. Issue Benny a guest WiFi access code.
She closed the alert without writing it up.
At 11:07 PM that night, her phone buzzed. The MAC address A4:83:E7:22:01:FC was back on the network. She watched the traffic for a minute. DNS. NTP. weather.com.
She let it be.
Some things persist not because anyone decided they should, but because nobody decided they shouldn't.