A menacing prologue, narrated by an unnamed figure, declares that certain people believe they are invincible, but the narrator has decided it is time for them to pay.
Mackenzie, the first-person narrator, reluctantly prepares for a weekend trip to a remote cabin in the Lake District in northern England. The cabin belongs to the family of Josh, a boy Mackenzie openly despises. She is going for her friends: her best friend Courtney, who is Josh's girlfriend; Aaron; Megan; and Kyle. The group has been strained since a car accident months earlier that killed two friends, Tilly and Gigi. After the crash, Josh callously said he was glad it was Tilly and Gigi who died rather than himself and Courtney. Courtney, loyal to Josh to a fault, has asked everyone to put their differences aside, and Mackenzie agrees.
Blake, Josh's estranged older brother, joins the trip. He moved away with his father after their parents' divorce and barely knows anyone in the group. During the drive, Blake bluntly asks Mackenzie why she hates Josh. He reveals he and Josh rarely saw each other growing up, and he can count on one hand the times he has seen his mother in 12 years. Mackenzie is drawn to Blake's directness, and when they walk in the surrounding woods, he reads her with unnerving accuracy, guessing that she hides secrets and exhausts herself holding everyone together. The physical chemistry between them is immediate.
That evening, the group drinks heavily. Arguments erupt: Aaron and Josh clash over Tilly's death, with Aaron threatening to kill Josh if he ever says Tilly's name again. Mackenzie feels unusually ill, far groggier than the amount she drank should warrant. She throws up and falls asleep on the sofa. Blake wakes her in the middle of the night, and they sleep together.
The next morning, Mackenzie and Blake discover Courtney and Josh lying in a pool of blood on the kitchen floor, stabbed to death. Kyle calls emergency services. Aaron immediately accuses Blake. Detective Inspector (DI) Wright, the lead detective, reveals there is no evidence of forced entry: Both doors were locked from the inside. He concludes that either the killer had a key or one of the five survivors is the murderer. The group is taken to the police station for questioning.
In the following days, the community turns hostile toward the survivors. At Josh's wake, Blake notes he appears in only three of over 60 photos on a wall collage. He tells Mackenzie his mother always preferred Josh and that he feels like he is at a stranger's funeral. Josh's uncle Pete confronts Mackenzie, accusing the group of murder. At Courtney's funeral, Wright drops a bombshell: All seven people at the cabin tested positive for Rohypnol, a powerful sedative. Mackenzie argues this proves an outside intruder drugged them, but Wright counters that the killer likely drugged themselves after committing the murders to hide among the victims, making the crime premeditated.
Mackenzie and Blake begin investigating on their own. They find a biscuit wrapper with blood on it in a shed near the cabin and take it to Wright. Mackenzie also discovers her friends have been hiding secrets. Kyle confesses he and Courtney had an eight-month secret affair; Courtney promised to leave Josh but chose him, leaving Kyle consumed with bitterness. Megan confesses that she spiked Gigi's drink with vodka on the night of the car accident. She and Gigi had a secret sexual relationship that only happened when they were drunk, and Megan wanted to be with Gigi that night. Getting Gigi drunk forced the less-experienced Courtney to drive instead, leading to the fatal crash. Mackenzie advises Megan to keep quiet, since admitting to spiking a drink would make her look capable of drugging people.
Mackenzie and Blake both begin receiving anonymous threatening texts warning them to stop investigating. The investigation takes darker turns: Aaron is questioned after the blood on the wrapper is identified as his, and Pete is beaten with his own cricket bat and later dies from his injuries. Mackenzie and Blake exchange personal confessions. Mackenzie reveals that at 15, she had an abortion, and Josh was the only person who knew; he had been blackmailing her ever since, using the secret to control her. Blake reveals that at 16, consumed by rage over his mother's rejection, he severely beat a man. Wright overhears both confessions and theorizes that Mackenzie killed Josh to end the blackmail, then killed Courtney because she witnessed it. Mackenzie denies everything.
Blake is arrested after his mother Eloise finds Courtney's earrings and Josh's necklace chain hidden in his room. Mackenzie argues the items were planted, since the police already searched the room and found nothing. Blake is released without charge, and the two officially become a couple.
Mackenzie is attacked outside Megan's house, hit on the back of the head, and receives a threatening text: "Tell anyone and I'll finish the job." Late that night, replaying video Kyle filmed at the cabin, she recognizes the distinctive sound of clunky footsteps from her attack. Her phone rings, and she recognizes the caller's voice: "Mackenzie, it was me." Mackenzie responds, "I know."
She goes to Aaron's house, where he has gathered all five survivors. Aaron confesses to murdering Courtney, Josh, and Pete, claiming they did not care about Tilly and Gigi. He demands the group help him frame Blake by stabbing him and calling it self-defense. When Blake refuses, Aaron lunges with a knife and stabs Blake in the side. Kyle pins Aaron to the floor, and Aaron is arrested. Blake recovers from the wound.
Eighteen months later, Mackenzie and Blake visit Courtney's grave. Mackenzie has been in therapy for 16 months and trusts only her parents and Blake. They stop at Megan's house and find her sitting at the kitchen table with a gun.
Megan confesses that she, not Aaron, is the real killer. Aaron has been in prison for 18 months to protect her, but he can no longer endure it and plans to recant his confession. Megan explains her motive: She was secretly in love with Gigi, and Courtney's and Josh's roles in the accident, combined with their indifference afterward, drove her to revenge. She obtained Rohypnol from a former classmate, laced a bottle of Italian liquor, gave heavier doses to the group so they would pass out and lighter doses to Josh and Courtney so they would remain groggy but conscious, then went downstairs and stabbed them both. She changed clothes, dumped the evidence in the river, and went to bed. She killed Pete when he discovered the truth, planted evidence in Blake's room during Josh's wake, and sent all the threatening texts.
Megan reveals a final scheme: She has planted a blood-soaked hoodie at Blake's father's house, left a voice mail for Wright claiming Blake has been threatening her, and arranged for the burner phone to be found among Blake's belongings. She intends to shoot herself to make it appear Blake drove her to suicide, noting his fingerprints are on the gun because he picked it up minutes earlier. Despite desperate pleas from Mackenzie and Blake, Megan raises the gun and pulls the trigger, dying instantly. Mackenzie clings to Blake and, realizing all of Megan's planted evidence will point to him, whispers a single word: "Run."