Loading story…
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias "Loot" to send more than 60 extortion emails between December 2023 and January 2024 demanding $2.5 million in cryptocurrency.
The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the "Loot" persona.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In March 2026, a federal jury convicted Cameron Curry on six counts of transmitting or causing interstate communications with intent to extort the victim company. The conviction followed evidence that he abused his insider access to obtain sensitive records and threaten their disclosure.
On January 24, 2024, the FBI executed a search warrant at Cameron Curry's residence and seized electronic devices and computer equipment. Subsequent forensic analysis tied Curry to the "Loot" alias used in the extortion scheme.
After learning his contract would not be renewed, Cameron Curry used the alias "Loot" to send more than 60 extortion emails to employees and executives of the victim technology company, demanding $2.5 million in cryptocurrency and threatening to leak sensitive corporate and employee data. The campaign ran from December 11, 2023, to January 24, 2024.
Cameron Curry was sentenced to 24 months in prison for the cyber extortion scheme, along with one year of supervised release and a $7,540.92 money judgment. Prosecutors said he targeted a Washington, D.C.-based international technology company where he had worked as a contractor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcebitdefender.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cameron Nicholas Curry, a 27-year-old North Carolina contractor who used the alias **"Loot,"** was found guilty on six counts of extortion after stealing sensitive data from a Washington, D.C.-based international technology company and using it to demand ransom. Prosecutors said Curry worked as a data analyst contractor and, between August and December 2023, exfiltrated a large volume of corporate information, including employee and compensation data, before turning the stolen material into leverage against the company. After his contract ended, Curry allegedly sent more than 60 threatening emails demanding payment in exchange for not leaking or destroying the data, and the victim company contacted the FBI on December 14, 2023. The organization ultimately paid about **$2.5 million** in January 2024, but investigators traced Curry through basic operational security failures, including a Coinbase account created with personal information and debit cards tied to family members; he was arrested in Charlotte in late January 2024 and now faces up to 12 years in prison at sentencing.
Jun 29, 2026
Former Brightly Software contractor Cameron Nicholas Curry was sentenced to two years in prison and one year of supervised release for an insider cyber extortion scheme against the Siemens-owned company. Prosecutors said Curry abused his legitimate access as a data analyst between August and December 2023 after learning his contract would not be renewed, stealing sensitive corporate, payroll, compensation, and employee personally identifiable information and using the alias **"Loot"** to threaten staff and executives. Investigators said Curry sent more than 60 extortion emails demanding about **$2.5 million** in cryptocurrency and warning that stolen data would be exposed if Brightly did not pay. The company ultimately transferred about **$7,540** in Bitcoin before reporting the incident to the FBI in December 2023. Authorities later searched Curry's residence, seized electronic devices, and tied him to the campaign through operational security failures, including a Coinbase account allegedly funded with debit cards belonging to his mother and sister. He was convicted on six extortion counts in March.
Aug 14, 2026
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026