Mara’s radio dies beneath her, but the hospital route remains active. Orchid takes the security badge and phone, leaving the operative concealed among the freight stacks.
She reaches St. Agnes through the service road and presents Mara’s credentials at a staff entrance. The lock releases, preserving the stolen access route for now.
Near the hospital’s service levels, Orchid enters a neglected records office. Dusty binders crowd metal shelves, while one aging terminal glows beside stacked paper manifests.
The terminal displays recent cash-handling activity tied to the ransom account: contractor transfers, emergency access windows, and repeated entries under VARGA.M.
Keskiyön Orkidea
The payment windows overlap the maintenance annex access schedule.
A manifest lists Eli Mercer as an unauthorized patient hold beneath the building, but no rescue alert has been issued. The annex remains occupied and sealed.
Beyond the office door, hospital ventilation hums through the service corridor. No attacker appears, leaving Orchid time to compare names, payments, and access windows while the route stays live.
✓ Quest Accepted
Confirm the ransom payment channel
+ New Item Acquired
Security badge
“I close the door behind me after entering, and quickly look more into the ransom account accessing the terminal. Background information on the transfer process or other related contingencies do not concern me. I try to figure out how I may transfer the ransom to my account, and then delete all saved data to erase any of my tampering, along with everything created by the VARGA.M account.”
FAILURE (Good Reasoning, rolled -1)
Keskiyön Orkidea closes the records-office door until the latch catches. The ventilation hum and terminal glow become the room’s only movement.
She opens the ransom account’s transfer history and follows the latest VARGA.M authorization, comparing its destination fields with the hospital’s payment interface.
Keskiyön Orkidea
The account is a relay, not an ordinary deposit account.
She enters a controlled transfer to an account under her control, but the terminal rejects the destination before submission. A compliance hold has frozen outgoing funds pending dual authorization.
Orchid shifts to deletion. The interface accepts removal commands for local manifests and VARGA.M records, then changes every selected entry to restricted audit status instead.
The terminal records her session identity, timestamps the failed transfer, and invalidates the visible VARGA.M credentials. The account data remains preserved on the hospital system.
The screen settles on a warning: forensic preservation active. Her attempt has removed her immediate access and created an indelible session trail, leaving the ransom untouched and the records locked.
“For a moment, I sit there, staring at the screen of denials, then turn toward the files and papers surroundings the room, searching for anything that may directly be tied to the terminal's settings so that I can bypass its security.”
FAILURE (Mediocre Investigation, rolled -1)
Keskiyön Orkidea sits before the denial screen for a moment, its warning reflected across her pale face. Then she turns to the binders and loose manifests surrounding the terminal.
She sorts maintenance schedules, printed access procedures, and discarded payment reports into separate stacks, preserving their order while searching for references to the terminal’s configuration.
Keskiyön Orkidea
The security settings are maintained outside the payment interface.
A folded emergency-maintenance sheet reveals the terminal’s model, local administrator path, and a recovery procedure requiring a hospital systems token plus dual authorization.
A handwritten notation links the procedure to VARGA.M, but the attached recovery code is stamped expired. The token field is blank, with no substitute recorded in the files.
She tests the documented administrator path without submitting another credential. The terminal recognizes the route, then seals the local settings panel behind the active forensic-preservation lock.
The papers provide the architecture but no bypass. The screen now permits only read-only viewing, while the expired procedure and invalidated VARGA.M identity make repeating the same search useless.
“I reorganize the papers as they were before I tampered with them, then turn back to the terminal. I stare at for a second, then scoot out of the chair and trace its connection cable. If I can't access it, and only VARGA.M can, then I will have to focus on finding another way to transfer the hospital's ransom money to my account. In the meantime, I work on finding a discreet way of destroying the terminal so that nobody can access it, and I erase my imprinted information on the device, along with all of the progress made by the existing account's relay.”
FAILURE (Good Reasoning, rolled +0)
Keskiyön Orkidea returns the binders and manifests to their original order, aligning corners and restoring each paper’s former place before leaving the desk.
She traces the terminal’s cable beneath the desk and along the wall. It joins a bundled hospital data line, not an isolated connection, disappearing into a locked service conduit.
Keskiyön Orkidea
The terminal is only a relay point. The hospital network carries the account elsewhere.
She examines the casing, vents, power lead, and nearby maintenance labels, looking for a discreet way to disable the machine without disturbing the surrounding records office.
The terminal’s enclosure resists quiet tampering. Its forensic lock also preserves the failed session, and the hospital system has already invalidated the local relay credentials.
A maintenance label exposes a usable distinction: the terminal authenticates through a separate systems token service, while payment authorization routes through the hospital finance server.
The attempt leaves the terminal intact and her imprint preserved, but the finance server’s identifier and the token service location now offer two separate paths to pursue.
“I unplug the terminal's cable to momentarily turn off and reset its display. After a second, I plug it back in again and circle back around toward its screen. I seat myself again, and try to gather information on the finance server's identifier.”
SUCCESS (Mediocre Investigation, rolled +4)
Keskiyön Orkidea unplugs the terminal’s cable. The display dies, leaving the records office briefly lit only by the corridor’s thin spill of hospital light.
After one second, she reconnects the cable. The terminal restarts into its preserved read-only session, retaining the forensic warning and the previous access context.
She circles back to the screen, seats herself, and reviews the available system labels without attempting another credential or changing the locked records.
The finance server identifier appears in the payment interface’s routing details: STAGNES-FIN-04, hosted through the hospital’s internal finance segment.
Keskiyön Orkidea
The finance server is STAGNES-FIN-04. The token service remains separate.
A read-only audit pane confirms the latest VARGA.M payment request was routed through STAGNES-FIN-04 before the compliance hold preserved it for review.
The terminal settles into its quiet hum again. Orchid now has the finance server’s identifier, the routing relationship, and the separation between payment authorization and token authentication.
“I investigate further in locating the hospital system's token service and any authorized staff for dual authorization. The staff that I may find might clue me in who specifically I need to kill to get what I want. I already plan on killing the owner of the VARGA.M account, seeing what control they have over the operation thus far.”
FAILURE (Mediocre Investigation, rolled +1)
Keskiyön Orkidea opens the terminal’s read-only infrastructure labels and follows the authentication references beyond STAGNES-FIN-04. The directory identifies a separate systems token service beneath the administrative wing.
The location field is incomplete, but the authorization matrix is clear: a finance controller and a clinical systems administrator must approve recovery together. Their staff IDs are listed beside the requirement.
She opens the personnel references. The forensic lock rejects the query, records the attempted lookup, and seals the directory pane behind an audit notice. Further searching from this terminal is no longer available.
Keskiyön Orkidea
The token service is below administration, and two separate authorities control access.
A cached maintenance index remains visible before the pane closes. It names the required roles as Dana Holt, finance controller, and Dr. Miriam Vale, clinical systems administrator.
The index also shows their badge zones: Holt’s office near finance records, Vale’s office beside clinical systems, and a restricted lower administrative corridor between them.
The terminal returns to its warning screen, preserving her new query in the session trail. The direct route is closed, but the names, offices, and corridor provide a usable path to the dual authorization.
“I have acquired what I can from the terminal. Its refusal to further access proves its use to me now obsolete. I stand up from my seat and move back to the cable near the wall, where I stomp hard onto it to crush the wire and generate heat within it. Then I move over to the terminal's grip itself, and loosen it enough to exacerbate heat buildup and concentrate poor electrical charge. To finish off my sabotage, I leave the connector against an important manifest, to catch fire and burn over time. This will get rid of my evidence, and still eliminate all of the original account holder's data by destroying the terminal itself, and the entire office once the fire spreads enough.”
SUCCESS (Fair Strength, rolled +2)
Keskiyön Orkidea rises and returns to the cable along the wall. Her heel comes down hard, crushing the insulation and deforming the wire beneath the floor trim.
She loosens the terminal’s grip and shifts the connector against a thick manifest stack. The damaged connection spits, warms, and begins feeding concentrated heat into the paper.
Keskiyön Orkidea
The terminal is no longer useful.
A small flame takes beneath the manifest’s edge, then climbs through the layered pages. Heat blackens the terminal casing while its warning screen flickers and dies.
Smoke thickens across the records office. It rolls over binders and shelving, catching discarded reports and maintenance forms as the fire spreads from desk to desk.
The smoke detector finally shrieks, and red emergency lights pulse beyond the door. The alarm is the concrete cost, carrying her presence through the service level.
Flames consume the terminal, the manifest stacks, and the office records. The finance trail and original account data vanish into smoke as Keskiyön Orkidea leaves the burning room.
“I close the door behind me to ensure the fire festers, controlled for as long as possible. If someone opens it, they risk an even worse inferno had it spread across the rest of the service level. After, I speed walk down the hall, masking my footsteps with the blaring sirens, and moving toward the finance records. As I draw closer, I move slower, and shift more carefully around corners to ensure I still have the element of surprise if I am to run directly into someone on the way.”
SUCCESS (Good Stealth, rolled +3)
Keskiyön Orkidea closes the records-office door until the latch catches. Smoke presses against the gap, while the contained fire continues feeding on paper and plastic inside.
She speed-walks down the service corridor, timing each step beneath the alarm’s shrill pulse. Red emergency lights smear across the walls, masking her movement and drawing staff away.
Keskiyön Orkidea
The alarm clears the finance corridor faster than ordinary traffic would.
Near the administrative junction, she slows and checks each corner through the narrow reflections of framed glass. No responder enters her path; the corridor remains empty.
She follows the finance-records signage past a propped fire door and reaches the records suite. Its access panel flashes green under the evacuation override.
The door opens into a darkened records room lined with locked cabinets and two unoccupied workstations. A printed evacuation roster lies exposed on the nearest desk, listing Dana Holt’s office location and current shift status.
“I was hoping to find Dana Holt in here already, but her not being here works as well. I move quickly toward one of the workstations and access the computer. I do not perform any further investigation. I move with efficiency on the device, trying to figure out if it's possible to transfer the hospital's ransom to an account I own, before actually trying to.”
SUCCESS (Good Reasoning, rolled +2)
Dana Holt is absent, as the evacuation roster indicated. Keskiyön Orkidea reaches the nearest workstation, wakes it, and moves through the finance interface without disturbing the other desks.
The workstation accepts the records-suite network session and opens a finance controller dashboard. The ransom account remains visible through a preserved audit link, despite the burned terminal.
Keskiyön Orkidea
The transfer function is available here, but authorization is separate from account ownership.
She follows the payment panel only far enough to inspect its destination fields. A new external account can be entered, and the interface supports routing funds to an account under her control.
The workstation displays the required sequence without submission: destination account, finance controller approval, and clinical systems confirmation. No transfer begins while the fields remain uncommitted.
Keskiyön Orkidea closes the destination form and leaves the ransom untouched. She now knows the hospital system can transfer it to her account from this workstation, provided the listed approvals are supplied.
Secure authorization for the ransom transfer
Quest Complete
Confirm the ransom payment channel
Attribute Upgrade: Reasoning Good→Great