A former data analyst contractor for Brightly Software was sentenced to two years in prison for targeting his employer as part of a $2.5 million extortion scheme.
Brightly is a Software-as-a-Service (SaaS) company formerly known as SchoolDude that was acquired by Siemens in August 2022. Brightly employs over 700 people and provides asset management and maintenance software to more than 12,000 customers worldwide.
Cameron Curry (aka “Loot”), 27, of North Carolina, was found guilty in March of orchestrating a “large-scale cyber extortion scheme” against his employer.
Accordingly Court documentsCurry stole sensitive documents after gaining access to the company’s payroll information and corporate data, which he later used to blackmail Brightly after learning his six-month contract would not be renewed.
A day after his contract expired on December 10, he sent emails to dozens of Brightly employees between December 11, 2023 and January 24, 2024 under the alias Loot and the email address lootsoftware@outlook.com, threatening to reveal the stolen information unless he was paid a $2.5 million ransom in cryptocurrency.
“We will gradually begin releasing salary information to all employees beginning January 1, 2024, and then report you to the SEC for your failure to report the breach,” Curry said in one of the extortion messages.
“If you wish to reclaim your data, we recommend that you do so immediately for $2.5 million to protect your business and inventory, as each additional month carries a $100,000 increase. The discrepancies on your books currently total over $16 million, posing potential risk for retention issues, a hostile work environment, resentment, and more.”
He also attached screenshots of employees’ personally identifiable information (PII), including their names, dates of birth, home addresses, and compensation information, and threatened to report Brightly to the U.S. Securities and Exchange Commission for failing to disclose the breach.
Following Curry’s numerous extortion emails, Brightly paid $7,540 in Bitcoin and transferred the funds to a cryptocurrency wallet controlled by Curry.
After the company reported the incident to law enforcement, the FBI searched Curry’s home on January 24 and seized various electronic devices containing evidence linking him to the extortion scheme.
“We are aware of the U.S. Department of Justice (DOJ) convictions against Cameron Curry for racketeering,” Brightly told BleepingComputer in March.
“We have cooperated fully with the FBI and the Department of Justice in this matter and appreciate their investigative efforts. Because this case is ongoing, we are referring all questions to law enforcement.”
In May 2023, Brightly also reported a data breach (unrelated to this case) after attackers stole credentials and personal information (including names, email addresses, account passwords, phone numbers) of nearly 3 million customers and users from the database of its online platform SchoolDude.
Overall prevention scores can hide what happens after the first access. Once attackers use valid credentials, prevention drops sharply.
The 2026 Blue Report measures defense technology for technology in 338 million simulations conducted in customer production environments.
