TL;DR
- what: Cameron Curry, a 27-year-old data analyst contractor from North Carolina, stole payroll records and employee PII from Brightly Software and ran a six-week extortion campaign under the alias "Loot" after his contract ended on December 10, 2023.
- impact: Employee names, dates of birth, home addresses and compensation details were emailed to dozens of Brightly staff as attachments; the company paid $7,540 in Bitcoin against a $2.5 million demand that escalated $100,000 per month.
- fix: There is no patch or CVE here; the control that mattered was same-day, verified deprovisioning of contractor access at contract end, plus refusing to negotiate before involving law enforcement.
- who: Any organization that grants contractors, consultants or fixed-term analysts access to HR, payroll or corporate data stores.
Cameron Curry's contract as a data analyst at Brightly Software ended on December 10, 2023. On December 11, the first extortion email arrived. Over the next six weeks, the 27-year-old North Carolina contractor — writing as "Loot" from lootsoftware@outlook.com — demanded $2.5 million in cryptocurrency from his former employer, threatened to escalate by $100,000 every month, and mailed dozens of Brightly employees attachments containing their own names, dates of birth, home addresses and compensation details. Brightly paid $7,540 in Bitcoin before it reported the campaign to law enforcement. In March 2026, Curry was found guilty. He was sentenced to two years in prison.
The gap between the last day and the last login
Brightly Software — formerly SchoolDude — is a SaaS provider of asset and maintenance management tooling used by more than 12,000 client organizations worldwide. Its customer base skews toward school districts, municipalities and facilities teams: organizations that are not, as a rule, staffed to survive a determined insider. But the data at the center of this case was not customer data. It was Brightly's own: payroll information, corporate documents, and the personally identifiable information of its own employees. The reporting does not detail how Curry retained the ability to reach it after his contract ended, and it is worth being precise about that — we do not know whether this was orphaned credentials, data staged before his last day, or something else. What we do know is the timeline, and the timeline is damning on its own. Access to payroll-grade data and a terminated contractor coexisted long enough for a six-week campaign to run.
The pressure was social, not technical
The most instructive part of this case is not the exfiltration. It is the leverage design. Curry did not encrypt anything. He did not need to. He went straight at the two soft points every company has: its employees and its regulators. He set a public deadline — "We will commence the process of disseminating salary information starting January 1, 2024 in phases to all employees" — and paired it with a threat to "report you to the SEC after for not reporting the breach." Then he proved capability by mailing staff their own records. That combination turns an IT incident into an internal trust crisis and a compliance exposure simultaneously, and it does it in the last three weeks of a fiscal year when legal and HR bandwidth is at its thinnest.
⚠️ Salary data is the highest-leverage file in your environment — Ransomware crews threaten your customers. This actor threatened your staff with their own compensation numbers. Payroll and HRIS exports carry uniquely corrosive blast radius: the moment they circulate internally, you are managing morale, pay-equity disputes and attrition on top of the breach itself. Treat compensation data as a crown-jewel dataset with its own access review cadence, not as a routine HR system of record.
The $7,540 that bought nothing
Brightly paid $7,540 in Bitcoin against a $2.5 million demand before reporting the matter to law enforcement. That is roughly three-tenths of one percent of the ask. Whatever the intent — a good-faith gesture, a stalling tactic, a test of the channel — the outcome is the one to internalize: it did not stop the campaign. Emails continued until the FBI searched Curry's residence on January 24, 2024 and seized electronic devices containing evidence. Brightly subsequently stated it "fully cooperated with the FBI and DOJ," and that cooperation is what produced the conviction. The payment is what produced a line item.
The RedEye take
Two years is a real sentence, but it is not the headline number in this story. The headline number is 26 months — the elapsed time from the FBI search in January 2024 to the guilty verdict in March 2026. If your insider-risk program is built on the assumption that prosecution is a deterrent, understand what deterrence actually looks like from the inside: a two-year wait, discovery, employee witnesses, and reputational exposure you do not control. Curry's demand was $2.5 million, and the criminal justice system worked. It still cost Brightly more than the $7,540 it wired. Our position is blunt: the only control in this chain with meaningful return on investment sits before the crime, in the 24 hours around a contractor's last day. Every dollar spent on same-day, verified deprovisioning outperforms every dollar spent on post-incident response here — and the industry keeps under-funding it because offboarding is an HR ticket, not a security project. It should be both. The second RedEye position is on the payment. Paying a small amount to an extortionist before involving law enforcement is not a hedge; it is a signal that the channel is live and the target is negotiating. Brightly's recovery began when it stopped paying and started cooperating.
What defenders should learn
- Tie contractor access expiry to the contract end date in the source system, not to a manual ticket. Curry's contract ended December 10 and the extortion started December 11 — offboarding that runs on a weekly or biweekly access-review cadence would never have closed that window in time.
- Instrument bulk reads of HR and payroll data, not just writes. Most DLP tuning chases customer data and source code. Payroll exports, compensation tables and employee PII sets often sit outside that coverage because they are 'internal' — which is exactly why they made the ideal weapon here.
- Pre-decide your extortion payment policy and put the authority in writing. The decision to send $7,540 in Bitcoin was made under a January 1 deadline threat. Any policy that gets written during the incident will be written by whoever is most frightened at that moment.
- Build a plan for the employee-facing variant of extortion. This actor emailed dozens of staff their own records directly. Your comms playbook probably covers customers, regulators and press; if it does not cover 'employees receive their own stolen PII from an anonymous account before Legal has briefed anyone,' write that section this quarter.
- Treat the SEC-disclosure threat as an anticipated tactic, not a novel one. Extortionists now cite regulatory reporting obligations as leverage. The counter is procedural: know your materiality assessment and disclosure clock in advance, so a criminal cannot manufacture urgency you have not already planned for.
The offboarding test worth running this week — Pick three contractors whose engagements ended in the last 90 days. For each, verify — with evidence, not a checkbox — the exact timestamp their access to HR, payroll, file shares and SaaS admin consoles was revoked. If any gap exceeds 24 hours, you have the same exposure Brightly had, and you found it before someone else did.
Source: BleepingComputer, "Data analyst sent to prison for stealing data, extorting employer." https://www.bleepingcomputer.com/news/security/data-analyst-sent-to-prison-for-stealing-data-extorting-employer/
Originally published on RedEye Threat Intelligence.
Top comments (0)