Wendy Duran, an accountant at a law firm, marks what would be her missing daughter's 21st birthday by lighting a candle in a Hostess CupCake and singing alone. Three years earlier, her daughter, Morgan, left home at 18 after a bitter argument. Wendy and her husband, Edwin, a college professor, had clashed with Morgan over her much older boyfriend, Keith, and a troubling group of friends. After Morgan vanished, Wendy filed a police report and created a website with Morgan's photo. Their son, Dylan, suggested submitting family DNA to ancestry services. Nothing brought Morgan home.
On a cold January night in Wisconsin, Sharon Lemke, a retired woman living alone, steps outside to view a lunar eclipse. Through the kitchen window of the house behind hers, she sees a small girl, roughly five or six years old, washing dishes at 11 o'clock at night. Sharon knows the Flemings only by sight: Suzette, Matthew, and their teenage son. She has never seen a young child there. As she watches, Suzette appears, speaks angrily, yanks the girl's arm, and pulls her from view. Sharon photographs the scene but struggles to make sense of it.
Soon after, Sharon's daughter, Amy, an attorney in Boston, asks Sharon to take in Niki Ramos, a young woman Amy mentored as a court-appointed special advocate (CASA) while Niki was in foster care. Niki, now 18 and aged out of the system, needs a safe place. Sharon agrees and installs Niki in Amy's old upstairs bedroom. From that window, Niki begins watching the Fleming house with binoculars and one evening observes Suzette send a small girl outside to retrieve the family dog. The child's ill-fitting clothes and Suzette's harsh treatment remind Niki of her own foster care experiences. The two women agree something is wrong but decide to gather more evidence before acting.
The narrative shifts to reveal life inside the Fleming household. Mia, approximately six or seven, lives in a concealed basement room behind a wheeled bookcase that locks from the outside. Suzette, whom Mia calls "Ma'am," locks her in each night. Mia's days are consumed by household chores performed to Suzette's exacting standards, with physical punishment for mistakes. Her only source of affection is the family dog, Griswold. Suzette tells Mia she was "saved" and forbids photographs of her. Jacob, the Flemings' teenage son, is secretly kind, letting Mia eat at the table when Suzette is out and giving her books. Mia has taught herself to read by watching
Sesame Street but conceals this from Suzette, maintaining a compliant facade as a survival strategy. She has no memory of life before the Flemings and does not know her own birthday or last name.
Jacob's perspective deepens the picture. Suzette presents a charming public persona while terrorizing her family in private. Jacob knows that his father, Matthew, a former doctor who gave up his medical license under unclear circumstances, is being blackmailed by Suzette. She threatens to expose Matthew's past billing fraud and an extramarital affair if he contacts authorities about Mia. Jacob recognizes Mia is a prisoner but feels trapped, fearing criminal consequences for his entire family.
Niki finds work at the Village Mart, a nearby gas station run by two kind elderly brothers, Fred and Albert. Jacob becomes a regular customer, buying junk food his mother forbids. Niki befriends him and grows suspicious when he hesitates after she asks if other children live in his house. He buys snacks for "a little kid" he knows. When Niki protects Jacob from bullies outside the store, his trust in her deepens.
Sharon escalates the investigation. She approaches Suzette, pretending to seek playmates for young grandchildren. Suzette denies having small children, but as she turns to go inside, a girl with dark hair opens the garage door before Suzette yells at her to close it. On Amy's advice, Sharon contacts child protective services (CPS). A social worker named Franny Benson visits the Fleming home, where Suzette claims Jacob is her only child, though Franny notices a child's wash bucket on the kitchen floor. Inside the house, Matthew is alarmed by the inquiries and insists they come clean about Mia, but Suzette dismisses him and punishes Mia for opening the garage door.
Meanwhile, Jacob secretly purchases a DNA ancestry kit and collects Mia's saliva. The results reveal three relatives: grandparents Wendy and Edwin Duran, and an uncle named Dylan Duran. Jacob finds Wendy's Facebook profile and recognizes a resemblance between Mia and Wendy's daughter, Morgan. Afraid that reaching out could bring criminal charges against his father, he keeps the results to himself.
In a parallel storyline spanning several years, Detective Moore delivers two devastating updates to the Durans. First, Morgan's driver's license has been found at a dilapidated shack in rural Wisconsin where the male tenant's first name was Keith. Much later, Moore returns with worse news: Human remains found buried behind the demolished shack have been identified as Morgan through dental records. The medical examiner confirms Morgan had given birth, meaning the Durans have a grandchild they know nothing about.
Events accelerate when Suzette, rattled by the CPS visit and the neighbor's inquiries, decides to remove Mia. She feeds Mia oatmeal laced with sleeping pills and, after the child collapses, places her in the trunk of her car. Her plan is to return Mia to the same shack where she originally found the girl. Jacob comes home early, discovers Mia is gone, and tracks his mother's phone. He rushes to the Village Mart and tells Niki everything: His mother found Mia as a toddler near a dead woman's body in that shack, a man with a gun shot at them as they fled, and Suzette kept the child as a replacement for the infant daughter she lost to meningitis years before. Fred lends them his car, and Niki drives while Jacob navigates.
They locate Suzette's car on a remote road, but Mia is not visible inside. Suzette refuses to reveal the child's location and drives off. When the road dead-ends, Niki blocks the way with Fred's car. Suzette swerves to get past, loses control, and plunges into a roadside retention pond. As Niki wades toward shore, she hears a thin cry from the trunk. Mia's terrified voice answers; the child believes she has been buried alive. Niki guides Mia to find the interior trunk release, lifts her out, and calls 911.
At a medical clinic, a deputy gently interviews Mia through coloring activities. Mia draws her hidden basement room and Griswold and describes Suzette's punishments. Franny Benson arrives to take custody of Mia, who agrees to go only after Jacob reassures her by phone. Jacob gives a full statement; his father, having arrived with an attorney, confirms a deal shielding Jacob from charges. Jacob tells detectives about the DNA results, providing the crucial link to Mia's identity: Her grandparents are Wendy and Edwin Duran.
Amy flies home and serves as attorney for Sharon and Niki during their police statements. Niki announces her desire to become a social worker. Amy offers to pay her tuition, and Sharon invites Niki to continue living at the house while attending university. Moved to tears, Niki accepts, feeling for the first time since her mother's death that she is part of a family.
Detective Moore informs the Durans that Morgan's daughter has been found and that Keith William Caswell, Morgan's boyfriend, has been killed in a bar altercation. DNA confirms Mia's identity, and after a brief period in foster care, she comes to live with Wendy and Edwin. Mia has nightmares and flinches at physical contact but is generally happy, seeing a therapist and being homeschooled while Wendy takes a leave of absence.
Months later, Jacob, now living with his uncle in Minnesota, visits the Duran home with Griswold on a leash. Mia is overjoyed. Jacob tells her the dog is her gift, since he is leaving for college. He privately apologizes to Wendy for not speaking up sooner; she acknowledges his apology and notes that he was a victim too. As Jacob says goodbye, he tells Mia that Griswold was always hers: "He always did love you best."