The book begins as Lisbeth Salander is flown to Sahlgrenska Hospital. It picks up where The Girl Who Played with Fire left off.
In the hospital
After surgery, Salander is moved to an intensive care ward under guard, accessible only to police, doctors, nurses, and her lawyer, Annika Giannini (who is also Mikael Blomkvist's sister). Zalachenko, whom Salander injured with an axe, is two rooms away. Niedermann, thanks to botched responses from the local law enforcement, is on the run after murdering a police officer and carjacking and kidnapping a woman during his escape. Niedermann seeks help from his old friends at the outlaw Svavelsjö Motorcycle Club, kills the treasurer and steals 800,000 kronor before disappearing.
These events prompt immediate action from "the Section," a secret division of Swedish Security Service (Säpo) created for purposes of counterintelligence and responsible for Zalachenko's asylum and supervision. Evert Gullberg, founder and former chief of the Section, asks former Section associate Fredrik Clinton to become acting head of the Section and plots to deflect attention away from the Section by silencing Salander, Blomkvist and Zalachenko. They form a working alliance with the unsuspecting prosecutor of Salander's case, Richard Ekström. Dr. Peter Teleborian, the psychiatrist who supervised Salander when she was previously institutionalized on the Section's orders, provides Ekström with a false psychiatric examination and recommends that she be reinstitutionalized, preferably without a trial.
Gullberg, who has terminal cancer, murders Zalachenko in his hospital bed and attempts entry to Salander's room to murder her but is prevented by Giannini. Gullberg then commits suicide in the passage outside Salander's room. A distraught Giannini informs Blomkvist of the shootings. Section operatives stage a suicide for Gunnar Björk, the junior Säpo officer who had handled Zalachenko after the latter's defection, and who was Blomkvist's source of information about the Section. Other Section operatives burgle Blomkvist's apartment and mug Annika Giannini, specifically making off with copies of the classified Säpo file that contains Zalachenko's identity, and plant bugs in the homes and phones of Millennium staff. The timing of the attacks, as well as the property that was taken, causes Blomkvist to realize that the phones are tapped, and he begins to investigate the Section in earnest for a Millennium exposé.
Blomkvist hires Dragan Armansky's Milton Security to handle countersurveillance. Armansky, on his own initiative, informs Säpo Constitutional Protection Director Torsten Edklinth about the constitutional violations. Edklinth, along with his assistant Monica Figuerola, begins a clandestine investigation into the Section. After Figuerola confirms the allegations, Edklinth contacts the Justice Minister and the Prime Minister who approve a full investigation by Constitutional Protection, and later invite Blomkvist to a confidential meeting in which they are to share information. They agree to Blomkvist's deadline—he intends to publish his findings about the state's manipulation of Salander's constitutional rights on 15 July, the third day of her trial, and the government agree to arrest any identified ringleaders of the Section at the same time.
Blomkvist convinces Salander's doctor, Dr. Anders Jonasson, to return her Palm Tungsten handheld computer to her. Blomkvist arranges to have a cellular phone placed in a duct near Salander's room, granting her Internet access through the resulting hotspot, which she uses to maintain contact with the outside world and work on a statement for her upcoming trial. Jonasson also helps her fake complications from her surgery, so that she can remain in the hospital's custody (and out of the police's). Meanwhile, Blomkvist, Armansky, Bublanski, Edklinth and their allies continue their joint counter-surveillance of the "Zalachenko club," feeding them a disinformation campaign about Millenium's (supposed) passivity regarding Salander's trial. They identify nine central players in the Section. Additionally, Blomkvist and Figuerola become romantically involved.
Whilst all of the above is going on, Erika Berger leaves Millennium to be editor-in-chief at Sweden's largest daily paper, the (fictional) Svenska Morgon-Posten (S.M.P.). Though the board hired her to revitalize the paper's sagging circulation numbers, they shut down her every proposal, emphasizing profits over sustainability. Meanwhile, Henry Cortez, junior Millennium reporter, uncovers a story about a Swedish toilet-manufacturing company that engages child labour in Vietnam. His research reveals that the boss of said firm is Magnus Borgsjö, who is CEO and major shareholder at S.M.P. and hired Berger for her new position. Blomkvist gives a copy of the story to Berger, agreeing to delay its publication until August while she confronts Borgsjö and convinces him to resign gracefully.
Berger begins receiving graphic e-mails and threats from an anonymous source within S.M.P., most of them calling her a "whore." Erika asks her staff to remain on alert, but matters escalate when the stalker breaks into Berger's home and steals private materials, such as high school love letters, a sex tape made with her husband Greger Beckman, and her copy of Cortez's story. Berger engages Milton Security to help secure her home, and Armansky sends over former police officer Susanne Linder to provide protection while Beckman is abroad on business.
Salander, whilst engaged in her own homework, discovers Berger's plight and mobilizes the "Hacker Republic," an elite and international group of computer wizards, to assist. They determine that Peter Fredriksson, S.M.P. employee and former high school classmate of Berger, is the culprit. Linder steps outside the law to confront Fredriksson and recovers Berger's things. However, Fredriksson has already passed Millennium's exposé on to Borgsjö. Borgsjö orders Berger to suppress the story at Millennium or lose her job at S.M.P. Berger, her sense of journalistic integrity offended, instead runs the story in that day's issue of S.M.P. under Cortez's byline, and then resigns in protest over both this and her treatment by upper management. Borgsjö and Fredriksson are both forced out, whilst Berger is accepted back at Millennium with open arms.
As Salander's trial approaches, the Section abruptly realize that Blomkvist's and Millennium's seeming lack of preparation are simply a cover story for their (successful, if now detected) campaign of misinformation. Clinton, having no idea what Blomkvist knows or plans to publish, arranges to plant cocaine in Blomkvist's apartment and simultaneously hire two members of the Yugoslav mafia to murder him; their intention is to frame him as a drug dealer and thus destroy his credibility. The former is easily undermined by the security cameras installed by Milton Security, which capture the plant; the latter requires the intervention of Figuerola, Andersson, Modig and several others from both Säpo and Milton. Blomkvist and Berger are spirited off to a Milton safehouse, allowing Säpo to further the misdirection by claiming that the two hitmen simply had the bad luck to stop for a meal at the same restaurant as their police officers. Berger, meanwhile, intuits Figuerola's and Blomkvist's affair, and promises Figuerola to stay clear of Blomkvist as long as they are together.
The first two days of Salander's trial, on various counts of aggravated violence, proceed with relative calm. However, on the third day, Millennium's dual book-and-magazine exposé is published, the officers of the Section are arrested, Channel TV4 runs an hour-long program on the Section using (pre-recorded) interviews and material from Blomkvist, and Giannini systematically destroys Teleborian's testimony, proving: that the Section and Teleborian had conspired to commit Salander at age 12 to protect Zalachenko, that Salander's rights had been repeatedly violated, and that they were once again conspiring against her. Blomkvist and Edklinth provide evidence proving that Teleborian's recent "psychiatric assessment" of Salander was fabricated and that he is working with the Section to silence her. Teleborian is then arrested for possession of child pornography, which was found on his computer by Salander and her hacker friends, Plague and Trinity. Ekström, realizing that the law is (or should be) on Salander's side, withdraws all charges against her, and her declaration of incompetence is rescinded.
With the evidence and credibility of the prosecution shattered, the prosecutor drops all charges against Salander. Freed, Salander embarks on an overseas trip to forget the events. She spends several months at Gibraltar, among other things to pay a visit to the man managing the billions she had stolen from Hans-Erik Wennerström in The Girl with the Dragon Tattoo. She also tracks down Miriam Wu, who is studying at a university in Paris, and apologizes for putting her life in danger during the events of Played With Fire.
Salander soon discovers that being a "legally responsible citizen" involves its share of toil and drudgery. As Zalachenko's daughter, Salander is obliged to inherit half of his properties and wealth, while the other half goes to her twin sister Camilla, whom no one has heard from in more than a decade. Suspicious about an abandoned factory in her father's estate, she goes there to investigate. There, she discovers two dead women, and Niedermann, who had been hiding there from the police. After a brief struggle and chase, Salander outwits Niedermann by nailing his feet to the plank floor with a nail gun. She is tempted to kill him herself, but instead reports his location to Sonny Nieminen, acting head of the Svavelsjö biker gang, and then reports the entire brawl to the police. She leaves before the stand-off concludes, satisfied that both Niedermann and the Svavelsjö bikers have been brought to justice. (She later learns that Niedermann was killed by the bikers, and Nieminen by the police while resisting arrest.)
Back at her apartment in Stockholm, Salander receives a visit from Blomkvist. The story ends with the two reconciling.