By May Day, my cousin had installed seven employees in my garden office and declared the Wi-Fi part of their salary. Then the network isolated the laptop uploading my NHS letters into her health app—and the Information Commissioner’s investigator asked everyone to remain seated.
It began with what sounded like a small family favor.
My cousin Claire called on a Monday morning and said the building where she rented a desk had suffered an electrical failure. She ran a small digital health company, and she claimed she needed a quiet place to complete payroll before the end of the day.
Behind my house stood a garden office I had built after I began working from home. It was not luxurious, but it was private, insulated, heated, and connected to a fast network. Most days, I used it for paperwork and video meetings.
Claire asked to borrow it for a few hours.
I gave her a temporary access code and told her that she needed to leave before dinner. She thanked me repeatedly and promised I would never know she had been there.
When I looked through the kitchen window the following morning, however, two unfamiliar cars were parked along the fence.
Claire was back inside the office. Three other people were sitting around my desk with laptops and headsets. She rushed outside before I reached the door and explained that an important client project had expanded overnight.
She asked for four more days.
Because she was family, I agreed.
That decision allowed a temporary favor to become an occupation.
By Friday, the three employees had been joined by two more. The following week, seven people were using the office. They brought folding desks, monitors, ergonomic chairs, document boxes, a laser printer, and a coffee machine large enough for a restaurant counter.
A laminated schedule appeared on my wall. Delivery drivers began leaving parcels at my front door. My electricity usage climbed. My internet slowed during meetings. One employee knocked on my kitchen door to ask where I stored replacement toner.
I told Claire the arrangement had to end.
She did not apologize. Instead, she argued that the office had been underused and that her company was improving the space. She said the employees were quiet, the work was important, and I should be proud to help a family business.
When I reminded her that I had never agreed to host a business, she smiled and said families did not need contracts for everything.
The most revealing moment came several days later.
I was passing the open garden-office window when I heard Claire welcoming a new employee. She described the office, heating, coffee, and high-speed Wi-Fi as benefits included in the employee’s compensation.
She had transformed services I paid for into part of her company’s salary package.
That evening, I changed the wireless password.
Claire appeared at my back door almost immediately. She accused me of disrupting a working day and interfering with something she had promised her staff. When I pointed out that she was selling access to my network, she said I was being technical to avoid supporting her.
I could have disconnected everything and carried the equipment onto the path. Instead, I decided to document what was happening before the dispute became another family argument in which the loudest person controlled the history.
I photographed the desks and equipment. I saved Claire’s messages. I recorded the dates on which employees arrived and left. I listed the packages delivered to my address. I also created a separate guest network so the company’s devices were no longer connected to my personal computers, television, storage drive, or printer.
Each unfamiliar device received its own network profile. I did not access anyone’s messages or open their files. I simply enabled standard security alerts and device isolation rules.
For nearly two weeks, the new arrangement produced nothing more serious than bandwidth warnings.
Then I discovered that several of my personal folders had been disturbed inside the main house.
The folders contained insurance documents, tax records, and correspondence from the NHS. Claire denied entering the house. She suggested that I had moved the papers and forgotten.
One particular set of letters came from a hospital consultant. They included appointment dates, medication information, a referral, my NHS number, and details I had shared with almost nobody.
I began storing the remaining letters in a locked drawer.
I also reported my concerns about possible misuse of personal information. I could not prove that anything had been copied, but the combination of a health-technology company, missing medical correspondence, and unexplained devices operating from my property was too serious to dismiss.
An investigator connected with the Information Commissioner’s office contacted me. She explained that suspicion alone did not establish what had happened. She asked me to preserve messages, avoid accessing company data, and notify her if my network security produced evidence of an attempted transfer involving my personal information.
On May Day, that alert arrived.
I was eating breakfast when my phone vibrated. The security system had detected repeated transmissions from a laptop inside the garden office. The connection itself was encrypted, but automated file metadata associated with the transfer contained my full name.
Another entry contained my NHS number.
My first instinct was to run outside and pull the power cable. Instead, I called the investigator using the contact number she had provided.
She told me not to touch the device. She was already nearby with a technical specialist and asked whether I could confirm what was happening without closing any applications.
I walked into the garden office.
Seven employees were at their workstations. Claire stood over a black laptop at the central desk. The printer beside her held several newly scanned pages.
They were my NHS letters.
On the laptop screen, a progress bar showed the documents being uploaded into a health-management application. A patient profile was open beside it. Although the profile used a different name, the appointment dates and medical details matched my letters.
I asked Claire where she had obtained the documents.
She shut the paper folder and said I was misunderstanding a demonstration.
I pointed to my name on one of the scanned pages.
Claire claimed that I had volunteered to participate in a private test months earlier. I asked her to show me the consent form.
She said it was stored elsewhere.
One of the employees removed his headset. A woman near the printer looked from Claire to the NHS pages and said the team had been assured that every record used for development had been properly authorized.
Claire told everyone to continue working.
Then she reached toward the laptop.
The network isolation rule activated before she touched the keyboard.
The upload stopped. The application remained open, but the device lost access to both the internet and the rest of the local network. A security warning replaced the progress bar.
Claire ordered the employees to switch to mobile hotspots. Nobody obeyed.
A car door closed near the garden gate.
The investigator entered the office moments later, followed by a technical specialist. She identified herself and asked Claire who owned the laptop, who controlled the application, and who had authorized the use of the documents beside the keyboard.
Claire answered all three questions differently.
First, she said the laptop belonged to an outside contractor.
Then she said the application was managed by an employee sitting near the window.
Finally, she claimed that I had provided the documents voluntarily.
The employee near the window shook his head. He opened a company message thread on his own screen and showed the investigator instructions from Claire. In the messages, she told the development team that she would supply authentic documents so the application’s patient profiles would appear realistic.
Another employee produced a contract listing my home as the company’s regular workplace. He said Claire had told him she held a long-term lease on the garden office.
A third employee displayed a recruitment message describing office access, electricity, refreshments, and Wi-Fi as part of the compensation package.
Claire attempted to reach the isolated laptop again. The technical specialist stepped between her and the desk, holding out one open hand without touching her.
The investigator raised her hand and asked everyone to remain seated.
Nobody was to close a program, remove a drive, delete a message, or leave until the ownership and handling of the medical documents had been established. She asked the employees to keep their hands visible and to state whether they had accessed the application, scanned records, or received instructions about patient data.
The garden office became completely quiet.
The investigator then turned to Claire and asked why the interrupted upload had been initiated through Claire’s administrator account.
Claire said someone must have used her credentials.
The technical specialist pointed to the active session information. The account had been opened that morning on the same laptop. The system recorded several earlier uploads from the same device.
The investigator asked whether there were other paper records on the property.
Claire said no.
An employee near the printer looked toward a filing cabinet Claire had installed beneath one of the windows. Until that moment, I had assumed it contained company stationery.
The cabinet was locked.
Claire claimed she had lost the key.
The investigator did not force it open. She documented it, recorded Claire’s explanation, and arranged for the material to be preserved through the proper process. She also asked each employee to provide a written account of how they had been recruited and what Claire had told them about the office and the health data.
Their statements showed that most of them had no idea the office belonged to me.
Several believed it was an authorized company branch. Two said they had raised concerns about the realism of the patient documents but had been assured that the records came from paid volunteers. Another recognized a surname on a paper near the scanner and became visibly distressed. She believed it might belong to someone she knew.
The isolated laptop contained more than the unfinished upload involving my letters. Its transfer history indicated that multiple batches of documents had been processed through the health application.
That discovery shifted the situation beyond a private dispute.
Claire had spent weeks framing the conflict as an argument about family loyalty, unused space, and internet access. The evidence inside the office suggested that the location had provided something more valuable than free electricity and Wi-Fi. It had given her a private place to operate a company system using records she could not adequately explain.
The investigator did not announce conclusions in the garden office. She did not make theatrical accusations or promise immediate punishment. She preserved what could be preserved, recorded who was present, separated assumptions from evidence, and ensured that the quarantined device remained untouched.
For me, the most powerful moment was not the arrival of an official vehicle or the sight of the interrupted upload.
It was the moment the investigator asked everyone to remain seated.
Until then, Claire had controlled the room. She decided who could work there, what employees were told, which explanations counted, and whether my objections deserved attention. She had treated my property, utilities, address, and privacy as resources she could redistribute.
One calm instruction ended that control.
The seven employees stayed in their chairs. The laptop remained isolated. The NHS letters stayed on the desk as evidence rather than disappearing into another folder.
Claire could no longer redefine what everyone had seen.
When the employees eventually left, they carried only their personal belongings. The computers and document boxes that required examination remained where they were. For the first time in months, the garden office was silent.
I stood on the brick path and looked through the window at the rows of empty chairs.
What had begun as a request to use a desk for one afternoon had become an unauthorized workplace, a false employment address, and a potential medical-data investigation.
Claire had repeatedly told me that family members should not need formal boundaries.
She was right about one thing: I had trusted her without creating any.
I would not make that mistake again.
