The Hunch Files
By Stu Holmes. This is not a theory. It is a first-hand account of what surfaced after nearly a decade of picking through records, accounts, devices, and bills — and the pattern that remains after every innocent explanation has been exhausted.
For nine years I have been scavenging through my own digital trail. Emails, account logs, screenshots, photographs, carrier bills, device configurations, metadata — the sheer volume of it is now impossible to dismiss as bad luck or a few coincidences. Some of it looks like evidence that was simply forgotten to delete. Some of it is too glaring to hide. Some of it has survived because it was too hard to scrub without leaving a trace of its own.
I have also tried very hard to argue against myself. I have gone through an enormous volume of records, and the great majority of what looked alarming at first turned out to be explainable, coincidental, or something I did to myself. False positives are the normal case. I've discarded them. What is left is the residue: the instances that do not fold away, that point the same way, and that keep reappearing no matter how many times I test them against the innocent explanation.
The information I have started publishing here is small compared with what has been preserved. Original emails, metadata embedded in photographs, billing records, account logs, device images, and screenshots span years. There is also media interest, which means the account will need to withstand scrutiny from people who do this for a living. I want it to meet that standard.
I am not an IT professional. I've never been a technician, an engineer or a security analyst. I'd call myself reasonably handy with software, and that is the honest ceiling of it. Everything below should be read with that in mind, and I'd rather say so at the top than have someone point it out later.
But a layman's eye has one advantage: I have had to look at everything slowly, repeatedly, and without assuming I know what it means. The pattern I describe is the one that has survived that slowness. It is not the first pattern I saw; it is the last one left standing.
Presented as observations, not conclusions. Where I'm uncertain, I've said so in the entry itself.
2017 – 2019
Across this period I created a number of Outlook and Gmail accounts. One of them belonged to a work persona — a name I used while selling for a wine company. Because that identity was never a real person, I was in practice operating both sides of some correspondence. That was harmless at the time. In hindsight it created an opening in how data was held and handed between services, and it is the point I keep returning to.
Ongoing
Most of what I can document sits with the Microsoft account layer rather than with the domain registrar. Access, recovery paths and account linkage across a set of old mailboxes are where things stop making sense — not the hosting itself.
Various dates
Across the surviving records there are sign-in IP addresses at times and in places that do not correspond to anywhere I was, including in New Zealand. I accept that IP geolocation is imprecise and that VPNs, carrier routing and mobile roaming explain a great deal of this. Not all of it.
Various dates
I hold photographs of the configuration and installed software on Android devices connected to this. I was told they were carrying nothing and doing no tracking. What I photographed does not support that. I am not an analyst and I will not overstate what those images prove — but the plain answer I was given was not the answer the devices showed.
Various dates
Two emails in the record are 45 MB and just over 30 MB. Standard mail gateways should have rejected both. The only innocent explanation I can construct is packetised delivery over an Apple messaging protocol rather than conventional SMTP. I can't confirm that, and I'd genuinely like someone who knows to tell me.
Various dates
Optus billing shows an additional service and repeated location data that doesn't match my movements — including locations that would only mean something to someone who knows the people involved. I've been careful with this one. Carrier location data is coarse and frequently wrong.
Context
Accounts moved between my name, joint names, and back again. I believe there was a working assumption on someone's part that there was money to find, and a sustained interest in anything held jointly. There was never anything to find. I include this only because it supplies a motive that the rest of the pattern otherwise lacks.
I believe this is provable. The evidence I hold is significant — logs, photographs of devices and configurations, billing records, account screenshots, and a chain of events that keeps pointing the same way. The limitation is not that the material doesn't exist; it is that turning it into a clean, verifiable narrative takes time and care.
I'm working through it methodically with ChatGPT, separating the coincidences from the real signals, and there is no rush. This page is a stake in the ground, not the final report. As more of the evidence is organised, the account will tighten and the things that look strange now will either be explained or will become harder to dismiss.
I have proof. What is on this page is a teaser — a first laying out of the pattern, not the full disclosure of the evidence behind it. That comes next, piece by piece, as the work is done properly.
Think of DNA thirty years ago. What could be detected, matched and understood then was only a fraction of what forensic science can do now. The data is the same: as the processes and technology get better, the truth gets closer. The people behind this data invasion will be outed. And it was not the work of one person — that much is already clear.
This list matters. Anyone can publish suspicion. Publishing the limits of your own case — while the work continues — is the part that makes it worth reading.
I'm not going to. Not here, not yet. What I'll say is that this was not a stranger operating at random from the other side of the world. The pattern requires knowledge — of names, of habits, of places, of which accounts mattered. That narrows it considerably, and it narrows it somewhere uncomfortable.
Which is precisely why the standard has to be higher, not lower. A public accusation without proof damages the accuser and does nothing to the accused. So the record goes up, the name stays off, and the page does the work.
The worst part of this is not whether I was hacked or not. It is this: if I was, the people involved were so callous that they have ruined a man's life.
The feeling of being observed the whole time, of being doubted by others, of being made to feel stupid or as if I were imagining it — that is an incredibly offensive and cruel thing to do to someone. As this investigation continues, that is what sits at the centre of it. My human rights were taken away from me, and it nearly killed me.
That is the overarching issue. Whatever the technical verdict ends up being, the human cost is already known.
I'm not asking for sympathy and I'm not running a campaign. I'm putting the record where it can be found, and inviting anyone who recognises a detail — a date, a device, an address, a habit — to get in touch. That includes people who can tell me I've got it wrong. Especially those people.
This page is a personal account of the author's own experience and observations. It states opinions and recollections held in good faith, identifies no individual as responsible for any offence, and makes no allegation of criminal conduct against any named person. Corrections are welcome and will be published.