Loading story…
Cameron Nicholas Curry, a 27-year-old North Carolina contractor who used the alias "Loot," was found guilty on six counts of extortion after stealing sensitive data from a Washington, D.C.-based international technology company and using it to demand ransom. Prosecutors said Curry worked as a data analyst contractor and, between August and December 2023, exfiltrated a large volume of corporate information, including employee and compensation data, before turning the stolen material into leverage against the company.
After his contract ended, Curry allegedly sent more than 60 threatening emails demanding payment in exchange for not leaking or destroying the data, and the victim company contacted the FBI on December 14, 2023. The organization ultimately paid about $2.5 million in January 2024, but investigators traced Curry through basic operational security failures, including a Coinbase account created with personal information and debit cards tied to family members; he was arrested in Charlotte in late January 2024 and now faces up to 12 years in prison at sentencing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Justice Department announced that Curry was found guilty on six counts of extortion for stealing company data and using it to extort his employer. He faces up to 12 years in prison at sentencing.
Investigators identified Curry through operational security mistakes, searched his apartment, devices, and vehicle in Charlotte, North Carolina, and arrested him in late January 2024.
The victim organization ultimately paid approximately $2.5 million to Curry as part of the extortion scheme. The payment occurred in January 2024.
After Curry's contract ended and he sent more than 60 threatening emails demanding payment in exchange for not leaking or destroying the stolen data, the victim company notified the FBI. The report was made on December 14, 2023.
Between August and December 2023, Cameron Nicholas Curry, a data analyst contractor at a Washington, D.C.-based international technology company, used his network access to steal sensitive corporate data, including employee and compensation information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcejustice.gov
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias **"Loot"** to send more than 60 extortion emails between December 2023 and January 2024 demanding **$2.5 million in cryptocurrency**. The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the **"Loot"** persona.
Aug 19, 2026
Former Brightly Software contractor Cameron Nicholas Curry was sentenced to two years in prison and one year of supervised release for an insider cyber extortion scheme against the Siemens-owned company. Prosecutors said Curry abused his legitimate access as a data analyst between August and December 2023 after learning his contract would not be renewed, stealing sensitive corporate, payroll, compensation, and employee personally identifiable information and using the alias **"Loot"** to threaten staff and executives. Investigators said Curry sent more than 60 extortion emails demanding about **$2.5 million** in cryptocurrency and warning that stolen data would be exposed if Brightly did not pay. The company ultimately transferred about **$7,540** in Bitcoin before reporting the incident to the FBI in December 2023. Authorities later searched Curry's residence, seized electronic devices, and tied him to the campaign through operational security failures, including a Coinbase account allegedly funded with debit cards belonging to his mother and sister. He was convicted on six extortion counts in March.
Aug 14, 2026
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026