The novel opens with Anya Hase, a Dublin accountant, relaxing in the bath on a Wednesday night while her partner, Chris, is away in Los Angeles. She hears rustling from the attic above. Moments later, a masked, black-clad figure drops from the attic hatch and approaches. Thirty seconds later, Anya is dead, though her death is later ruled an accidental drowning.
Julia Birch recently relocated from San Diego to Dublin with her two children, Isla (13) and Luca (9). They live in Brentwood, a luxury gated community in Foxrock, south Dublin. Julia and her ex-husband, Gabe, an artist, alternate five-night stays at the house and a nearby apartment in an unconventional co-parenting arrangement. Isla resents the move, and Julia cannot reveal the real reason they left California: an incident involving Isla and a classmate named Riley.
Isla shows Julia a TikTok video tagged #TheLoft, part of a viral trend promoting a television series. The clip features a masked figure climbing out of an attic hatch and walking through a hallway that unmistakably contains Julia's belongings, including a distinctive sunburst mirror shipped from San Diego. Julia and Isla try to contact the account holder, Lepus123, but the account is deleted. Julia dismisses the video as a prank edited from Isla's own posts.
Julia meets her old school friend Eleanor Jordan-Keogh for Friday-night drinks. They are expecting their third friend, Anya, who never arrives. Eleanor discovers a Facebook post announcing Anya's sudden death: She apparently fell asleep in the bath and drowned, her body undiscovered until Chris returned on Friday morning. Eleanor draws a parallel to the death of Donna Wilson Straub, the fourth member of their friend group JADE (Julia, Anya, Donna, Eleanor). Donna died roughly 20 years earlier after falling from a rooftop at a house party.
In interspersed flashback chapters, the novel reveals the full story of Donna's death. During a night out in their early twenties, Anya secretly poured extra vodka into Donna's drinks, and Eleanor topped up her glass, causing Donna to become dangerously intoxicated. At a house party, Donna kissed Gabe and became violently ill. When Gabe searched for her, Anya told him Donna had left and gotten into a taxi. Eager to catch a rare cab, Julia, Eleanor, and Gabe left without checking. Donna, alone and sick on the rooftop, reached for a scrap of paper with Gabe's number as it blew away, overbalanced, and fell to her death.
Back in the present, new videos appear under variations of the Lepus username, showing detailed footage of Julia's home. Each account is deleted shortly after posting. Luca reports nighttime disturbances: footsteps on the landing, a eucalyptus smell, and the sensation of someone breathing near him. He insists a man is living in the attic. Julia reports the videos to the gardaí (Irish police) and checks the attic herself, finding only a single wireless earbud.
Julia meets several Brentwood neighbors: Alastair O'Ryan, a chatty man who claims to live in a nearby town house and seems unusually knowledgeable about Julia's household; Drew Redking, a personal trainer; and Shirin and Tony Hudson, the couple next door. Julia discovers that the hall smoke detector is actually a spy camera, which police trace to Tony, who installed it to gather evidence against Shirin over a prior affair.
At Anya's funeral, Chris's sister, Lynn, reveals that a small green stone paperweight shaped like a rabbit was found in Anya's bathroom the night she died. Chris did not recognize it. Meanwhile, Isla spots one of Gabe's paintings, a seascape he had given to Anya, in a Lepus video, confirming that a clip was filmed inside Anya's house and connecting the two targets.
Eleanor calls Julia one night, frightened by noises in her attic. Julia comes over and notices Eleanor's three-year-old daughter, Georgia, holding a small green stone figurine shaped like a rabbit, identical to the paperweight found in Anya's bathroom. They theorize the figurines are jade, connecting them to their JADE acronym, and conclude someone is targeting all three surviving friends as retribution for Donna's death. They report their theory to Detective Stilwell at the garda station.
Julia and Eleanor investigate Donna's brother Andy as a suspect, tracking him with Alastair's help to a house in Dalkey. Andy answers on crutches with a broken leg, clearly unable to have been climbing in and out of attics. He tearfully confesses he ignored Donna's phone call that night because he was too lazy to pick her up.
The group's theory shifts. Drew identifies the figurines as green peridot, not jade, dismantling the JADE connection. Alastair points out that "Lepus" means hare as well as rabbit, and that "Hase," Anya's surname, is the German word for hare. The campaign appears linked to Anya specifically. Raycroft Estates, the property management company overseeing Brentwood, recently employed an incompetent temp named Clive Gannet. Julia realizes this name is an anagram of Vincent Gale, a former Hase Accounting employee whom Anya had dismissed. Excited, Julia texts the discovery to Alastair.
Then Julia discovers spyware on her phone, the same surveillance app Alastair once mentioned in conversation. Shirin confirms Alastair does not actually live in Brentwood, and Eleanor confirms she never used Julia's childhood nickname "Juju" around him, contradicting his earlier claim. Julia realizes Alastair has been lying about everything: He is Vincent Gale. The name "Alastair" means avenger, and "O'Ryan" echoes Orion, a constellation at whose feet a hare sits.
Vincent re-enters the house using keys retained from his time at Raycroft. The locks were never changed because the supposed locksmith was Vincent himself. After Julia discovers a real-time video of herself streaming on TikTok, Vincent confronts her in the living room. He confesses to murdering Anya by holding her head underwater and explains that he planted clues throughout his campaign as a slow-burning game of revenge for the destruction of his career, his engagement, and his relationship with his daughter. He also reveals he has crushed sleeping pills into Julia's wine to stage her death as an overdose.
Julia, losing consciousness, forces herself to vomit to expel the drugs. Eleanor, who rushed over after Julia's earlier phone call, lets herself in with a spare key and strikes Vincent across the head with a fireplace poker, killing him.
Julia recovers in the hospital. Police confirm Vincent worked as a substitute dog-walker to gain access to Anya's house and took a temp job at Raycroft under his anagram alias to access Brentwood. The family's pet rabbit, Basil, had also gotten into the attic, partially explaining the footsteps Luca heard, though Vincent's nocturnal visits account for the rest.
The truth about Riley emerges: Isla learns that Riley's mother, Heather Walters, fabricated an assault story to punish the family. Riley was never attacked, and the move to Ireland was based on a lie. Tony Hudson's body is later found, killed by an explosion from a faulty coffee machine. Lynn discovers that Anya's secret affair was with Lynn's own husband.
Julia quits her job, reconnects Andy with his mother, and moves the family to a smaller house in Stillorgan. Isla settles into school, joins a soccer team, and makes friends. The novel closes with the observation that while there is no longer someone in the attic, there is always someone in the house.