Not sure if you're thinking of the same story, but this reminds me of Cliff Stoll finding KGB hackers poking around military and university networks in the 80s because of a time billing discrepancy.