A fictional thriller by Mayank Pokharna
Author’s note: This is a work of fiction. The protagonist happens to share my name, my career, and my questionable taste in working from freezing Himalayan towns with unreliable WiFi. Everything else is made up. Mostly.
Part I: The Signal
The email arrived at 3:47 AM IST on a Tuesday in February.
I was in Srinagar, sitting cross-legged on a houseboat on Dal Lake, finishing a cashflow model for a coliving operator in Sydney. The houseboat had no heating, my fingers were numb, and the WiFi was being routed through what I suspected was a potato. But I had promised Risto the CasaPay deliverable before the year ended, and I was not going to miss a deadline because of a vegetable-based internet connection.
The email had no subject line. The sender was listed as operator_101@proton.me. The body contained three lines:
I have been reading your newsletter for two years. I operate 4,200 beds across 11 cities. I need to meet you. Udaipur. December 19. The 101st city.
I stared at it. Then I stared at the frozen lake outside. Then I stared at it again.
Four thousand two hundred beds. Eleven cities. If that was real, this was one of the largest independent coliving operators I had never heard of. And in a decade of working in this industry, co-founding SimplyGuest, scaling it to 500 tenants across Bangalore, advising 70-plus operators across 15 countries, running the largest coliving newsletter in the world, I had heard of everyone.
Everyone who wanted to be heard, at least.
I typed a reply: Who is this?
The response came in four seconds: Come to Udaipur and find out. Lake Palace Hotel. Rooftop. 7 PM. Come alone.
I should have deleted it. I should have flagged it as spam and gone back to building pivot tables for a man in Sydney who wanted to know his cost-per-occupied-room across 83 suburbs.
Instead, I booked a flight to Udaipur.
Because Udaipur is where I grew up. And December 19 was the anniversary of the day I left.
Part II: The Operator
Udaipur in December is a different animal. The lakes are low, the tourists are thick, and the old city smells like a disagreement between diesel and cardamom. I had not been back in months. My parents still lived in the same house near Fatehpura. My mother still asked why I could not just get a government job.
The Lake Palace Hotel rooftop was empty except for one man.
He was maybe fifty-five. Silver hair, clean-shaven, wearing a linen kurta that probably cost more than my monthly Claude subscription. He was drinking chai from a steel glass, not the porcelain cups the hotel provided. He had brought his own glass. That detail told me more about him than any pitch deck could.
“Mayank Pokharna,” he said. Not a question.
“You have me at a disadvantage.”
“My name is Vikram Sethia. I operate a company called Greywall Living. And I have a problem that your newsletter cannot solve.”
He gestured for me to sit. A waiter appeared with chai. In a steel glass. He had ordered for me.
“Greywall Living,” I said. “I have never heard of you.”
“That is by design. We operate 4,200 beds across Jaipur, Jodhpur, Ahmedabad, Surat, Indore, Bhopal, Lucknow, Chandigarh, Coimbatore, Vizag, and Kochi. Tier-2 cities. No Bangalore. No Mumbai. No Delhi. No international expansion. No press. No LinkedIn posts. No conference appearances.”
“Why?”
“Because I am not building a brand. I am building infrastructure. And infrastructure does not need a newsletter.”
That stung slightly, but he was not wrong.
“So why contact me?”
He set down his chai. “Because three of my properties have had identical incidents in the last six weeks. And I think someone is using my own technology against me.”
Part III: The Pattern
Vikram explained it methodically, like a man who had spent forty years in real estate and had no patience for ambiguity.
Six weeks ago, his Jaipur property, 380 beds, 94% occupancy, his flagship, experienced a total system failure. The property management software crashed. Not the kind of crash where you restart the server. The kind where every tenant record, every lease agreement, every payment history, every maintenance ticket was wiped. Replaced with a single line of text repeated across every field in the database:
THE BEDS ARE NOT YOURS.
The Jaipur team restored from backup within four hours. No data was permanently lost. But the next week, the same thing happened in Indore. Then Lucknow.
Three cities. Three identical attacks. Three identical messages.
“What PMS are you running?” I asked.
“Custom-built. Internal team. We do not use off-the-shelf solutions.”
“Who built it?”
“A team of four engineers. All based in Ahmedabad. All with us for more than five years.”
“And you trust them?”
“I trust the two who are still alive.”
I set down my chai.
“The lead engineer, Deepak Mistry, was found dead in his apartment in Ahmedabad eleven days ago. Heart attack, according to the police. He was thirty-one years old and ran marathons. His backup, Priya Nair, died in a road accident in Kochi four days later. Single vehicle. No witnesses.”
“You think they were murdered.”
“I think someone wanted access to our source code, and when they could not get it from the system, they got it from the people who wrote it.”
I looked out over Lake Pichola. The City Palace was lit gold against the dark water. Udaipur looked exactly as it always did, beautiful and indifferent to the problems of the people who lived in it.
“Why me?” I said. “You need the police. Or a cybersecurity firm. I am a marketing consultant who writes about occupancy rates and SEO strategies.”
Vikram smiled for the first time. “You are a man who has worked with property management software across four continents. You have built PMS platforms. You understand how coliving technology works at the infrastructure level, SALTO integrations, payment processors, tenant lifecycle management, access control systems. You have reviewed more coliving tech stacks than anyone alive.”
He was not wrong. JumboTiger. The COHO architecture review. The CDA HubSpot build. The BookMyColiving platform I had vibecoded into existence in four weeks. I knew how these systems breathed.
“And,” he continued, “you are the only person in the coliving industry who is not connected to any investor, any fund, or any operator with a reason to want my company to fail. You are independent. That is rare.”
“I am also not a detective.”
“No. But you understand the building. And I believe the answer is in the building.”
Part IV: The Building
The Jaipur property was a converted haveli in the old city, four floors, 92 rooms, shared kitchens on each level, a rooftop coworking space with a view of Nahargarh Fort. Beautiful. Exactly the kind of adaptive reuse that makes coliving work in Indian cities where new construction is a regulatory nightmare.
I arrived at 6 AM, before the tenants woke up. The property manager, a sharp woman named Kavita, walked me through the operations.
“Show me the access control system,” I said.
SALTO locks on every room. Centralised dashboard. Every entry and exit logged with timestamps. Standard setup, I had specified exactly this system for HIVE in Dubai eight months earlier.
“Pull the logs for the night of the first breach.”
She did. And there it was.
At 2:14 AM on the night of the system wipe, a master key was used to access the server room on the ground floor. The server room had no camera, Vikram had not installed surveillance inside operational spaces, only in common areas. The master key belonged to a profile labelled ADMIN_OVERRIDE.
“Who has the admin override key?”
“Only Deepak had the credentials to generate one,” Kavita said. “And Deepak was in Ahmedabad that night. We verified.”
“Then someone cloned his access profile. Which means someone had access to the PMS backend with admin-level permissions.”
I sat down at Kavita’s desk and opened the PMS admin panel. The interface was clean, Deepak had been a good engineer. I navigated to the user management module.
There were 14 admin-level accounts. Twelve were staff. One was Deepak’s. One was Priya’s.
And one was an account created six months ago, with the username tenant_2847@greywall.in and admin permissions granted three weeks before the first breach.
Someone had created a fake tenant account, gradually escalated its permissions over several months, and used it to generate a master access key. They had been inside the system for half a year.
“Kavita, who is tenant 2847?”
She checked. “Room 412. Ananya Srinivasan. Moved in seven months ago. PhD researcher. Quiet. Pays rent on time. No maintenance complaints.”
“That last part is the problem,” I said. “Every tenant files at least one maintenance complaint. It is statistically impossible to live in a coliving space for seven months without a single issue. Either she is the most tolerant human alive, or she never intended to actually live here.”
Part V: Room 412
Room 412 was on the fourth floor, at the end of a corridor that smelled like instant noodles and ambition. The door was locked. Kavita used the property master key.
The room was immaculate. Bed made with hospital corners. Desk cleared. Wardrobe empty. The room had been vacated, recently. The mattress was still warm to the touch.
On the desk, a single item: a USB drive.
I should not have plugged it in. Any cybersecurity professional would have told me that plugging in an unknown USB drive is the digital equivalent of drinking from a stranger’s chai glass at a railway station. But I was not a cybersecurity professional. I was a coliving consultant with a blog and a dangerous level of curiosity.
The USB contained one file. A spreadsheet. And when I opened it, I felt the temperature in the room drop, or maybe that was just Rajasthan in December.
The spreadsheet was a complete financial model. Revenue projections, occupancy rates, CPOR, ADR, lease structures, landlord agreements, maintenance costs, and NOI calculations for every single Greywall Living property. Data that should have been impossible for anyone outside Vikram’s inner circle to access.
But that was not the alarming part.
The alarming part was the second tab. Labelled ACQUISITION MODEL.
It contained a detailed plan to acquire Greywall Living, property by property, city by city, by systematically crashing their PMS, destroying tenant trust, tanking occupancy, and forcing Vikram into a distressed sale. Each property had a timeline. Jaipur was Phase 1. Indore was Phase 2. Lucknow was Phase 3.
Phase 4 was Udaipur.
And the acquirer listed at the top of the model? A company I knew very well. A company I had, until this moment, considered a respected peer in the coliving industry. A company whose founder I had interviewed on my podcast, featured in my newsletter, and shared a stage with at three different conferences.
I pulled out my phone and called Vikram.
“I found the answer,” I said. “And you are not going to like who it is.”
Part VI: The Industry
I cannot tell you the name. Not because I am protecting anyone, but because this is a fictional thriller and naming a real coliving company as a corporate villain would be both defamatory and terrible for my consulting pipeline.
But I will tell you what happened next.
Vikram did not go to the police. He did not file a lawsuit. He did not write a LinkedIn post about integrity in the coliving industry.
Instead, he did something far more devastating.
He called me back to the houseboat in Srinagar three weeks later, January, this time, when the lake was properly frozen and the WiFi had downgraded from potato to turnip.
“I want you to build me a new PMS,” he said. “From scratch. Something no one can breach. And I want you to document every line of it so that if anything happens to me, the system survives.”
“I am not an engineer,” I reminded him. “I literally learned what GitHub was four weeks ago.”
“You built a two-sided marketplace with 2,500 pages in a month. You rebuilt an entire media platform. You produced 15 interactive tools. You did all of this without writing a single line of code yourself.”
“That is vibecoding. It is not the same as building enterprise-grade security infrastructure.”
“No,” he said. “It is better. Because you think like an operator, not an engineer. Engineers build what they are told. You build what the building needs.”
Part VII: The 101st City
It took eleven weeks.
I worked from seven different cities during the build, Srinagar, Bangalore, Goa, Dubai (meeting with the HIVE team), Sydney (reviewing CDA’s operations), London (sitting with the COHO team), and finally, back to Udaipur. Each city added a layer. Each operator I visited taught me something about resilience, about the quiet, unglamorous work of keeping a building running and a community alive.
The system we built was not technically revolutionary. It was operationally revolutionary. Every tenant interaction, every lock event, every payment, every maintenance ticket flowed through a single auditable pipeline. No admin overrides. No shadow accounts. Every permission change required two-factor approval from two different people in two different cities.
We called it Greywall Shield. Vikram called it “the thing that lets me sleep.”
On the day we deployed it, I stood on the rooftop of the Jaipur haveli and looked out at Nahargarh Fort. The same view that Ananya Srinivasan, or whoever she really was, had seen from Room 412 every morning for seven months while she systematically dismantled a man’s life’s work from the inside.
She was never found. The USB drive was forensically analysed and traced to a procurement chain that dead-ended at a shell company in Singapore. The competing operator denied everything, restructured their leadership team six months later for “unrelated reasons,” and pivoted to co-working.
Vikram’s properties recovered. Occupancy in Jaipur climbed back to 96%. The Lucknow property hit 98%.
And I added Udaipur to my list. City number 101.
The irony was not lost on me. I had set out to work from 100 cities as a digital nomad. The 101st was the city I had spent my entire childhood trying to leave. It turned out that the most important work of my career would bring me back to the place I started.
There is a lesson in that, I think. But I am a coliving consultant, not a philosopher. I will leave the meaning-making to the blog posts.
Epilogue: Steel Glass
I still have the steel chai glass that Vikram brought to our first meeting at the Lake Palace Hotel. He gave it to me the day we deployed Greywall Shield.
“In our family,” he said, “we do not drink from cups that someone else has chosen for us. We bring our own.”
I keep it on my desk. It reminds me that in an industry obsessed with scale, with venture capital, with acquisition multiples and exit strategies, the most important thing is still the building. The physical space where people live, and work, and try to figure out their lives.
Someone once asked me what coliving actually is. I said: it is the belief that strangers can share a kitchen and not kill each other.
After Jaipur, I would amend that slightly.
It is the belief that the space you build can survive the people who want to take it from you.
And sometimes, surviving is the most revolutionary thing a building can do.
Mayank Pokharna writes about startups, coliving, and life at pokharnatalks.com. He is currently on city 47 of his mission to work from 100 cities. The events in this story are entirely fictional. The chai preferences are real.
#calmhustle
