Loading story…
Former Brightly Software contractor Cameron Nicholas Curry was sentenced to two years in prison and one year of supervised release for an insider cyber extortion scheme against the Siemens-owned company. Prosecutors said Curry abused his legitimate access as a data analyst between August and December 2023 after learning his contract would not be renewed, stealing sensitive corporate, payroll, compensation, and employee personally identifiable information and using the alias "Loot" to threaten staff and executives.
Investigators said Curry sent more than 60 extortion emails demanding about $2.5 million in cryptocurrency and warning that stolen data would be exposed if Brightly did not pay. The company ultimately transferred about $7,540 in Bitcoin before reporting the incident to the FBI in December 2023. Authorities later searched Curry's residence, seized electronic devices, and tied him to the campaign through operational security failures, including a Coinbase account allegedly funded with debit cards belonging to his mother and sister. He was convicted on six extortion counts in March.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Curry was found guilty in March on six counts of extortion for the scheme targeting Brightly Software. The conviction followed the federal investigation into his insider attack and ransom campaign.
On January 24, the FBI searched Curry's residence and seized electronic devices. Investigators found evidence on the devices linking him to the extortion scheme.
Brightly ultimately paid $7,540.92 in Bitcoin, less than 1% of Curry's original ransom demand. Prosecutors said the payment was made in late January 2024 and sent to a wallet Curry controlled.
Brightly Software notified the FBI about the insider extortion breach after receiving Curry's threats. This report triggered the federal investigation that quickly identified him through operational security mistakes.
Using the alias "Loot," Curry began emailing Brightly employees and executives with threats to leak stolen data unless the company paid $2.5 million in cryptocurrency. One source says he emailed dozens of employees between December 11, 2023, and January 24, 2024.
Prosecutors said Cameron Curry used his legitimate network access as a Brightly contractor between August and December 2023 to remove sensitive corporate, employee, and compensation data. The theft began after he learned his six-month contract would not be extended.
An unrelated Brightly/SchoolDude breach was disclosed in May 2023, exposing credentials and personal data from the SchoolDude platform database. The reporting notes this incident was separate from Cameron Curry's extortion case.
Siemens acquired Brightly Software, the SaaS company formerly known as SchoolDude. This corporate ownership context is cited in reporting on the later insider extortion case.
The U.S. Department of Justice announced that Cameron Curry was sentenced to two years in prison for the insider extortion attack against Brightly Software. He also received one year of supervised release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias **"Loot"** to send more than 60 extortion emails between December 2023 and January 2024 demanding **$2.5 million in cryptocurrency**. The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the **"Loot"** persona.
Aug 19, 2026
Cameron Nicholas Curry, a 27-year-old North Carolina contractor who used the alias **"Loot,"** was found guilty on six counts of extortion after stealing sensitive data from a Washington, D.C.-based international technology company and using it to demand ransom. Prosecutors said Curry worked as a data analyst contractor and, between August and December 2023, exfiltrated a large volume of corporate information, including employee and compensation data, before turning the stolen material into leverage against the company. After his contract ended, Curry allegedly sent more than 60 threatening emails demanding payment in exchange for not leaking or destroying the data, and the victim company contacted the FBI on December 14, 2023. The organization ultimately paid about **$2.5 million** in January 2024, but investigators traced Curry through basic operational security failures, including a Coinbase account created with personal information and debit cards tied to family members; he was arrested in Charlotte in late January 2024 and now faces up to 12 years in prison at sentencing.
Jun 29, 2026
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026