A former contractor who targeted Brightly Software in the Cameron Curry Brightly Software extortion scheme has been sentenced to two years in prison after demanding $2.5 million in cryptocurrency from his employer. Curry, 27, from North Carolina, was found guilty in March of orchestrating what court documents describe as an ‘extensive cyber extortion scheme’ against the company.
Curry had been working as a data analyst contractor for Brightly, a Software-as-a-Service (SaaS) company formerly known as SchoolDude, which was acquired by Siemens in August 2022. Brightly employs over 700 people and provides asset management and maintenance software to more than 12,000 clients worldwide. When Curry learned that his six-month contract would not be extended, he decided to leverage the access he had already obtained.
How the Cameron Curry Brightly Software extortion unfolded
One day after his contract ended on 10 December 2023, Curry began emailing Brightly employees under the alias ‘Loot’, using the address lootsoftware@outlook.com. According to WLOS, Curry sent more than 60 emails to company employees and executives between 11 December 2023 and 24 January 2024, a sustained, months-long campaign rather than a single panicked blast.
The messages were explicit about the threat. ‘We will commence the process of disseminating salary information starting January 1, 2024 in phases to all employees and will report you to the SEC after for not reporting the breach,’ Curry wrote in one email. ‘If you wish to reclaim your data, we recommend doing so promptly at 2.5 million USD in order to save your company and stocks, as each subsequent month will incur a $100,000 USD increase. Discrepancies in your books are currently over 16 million USD, posing a potential risk for retention issues, a hostile work environment, resentment, and more.’
Curry had stolen sensitive documents after gaining access to the company’s payroll information and corporate data. He attached screenshots of employees’ personally identifiable information (PII) to the messages, including names, dates of birth, home addresses and compensation details. He also threatened to report Brightly to the U.S. Securities and Exchange Commission (SEC) for failing to disclose the breach, adding a regulatory threat to the financial one.
Brightly ultimately paid. The company transferred $7,540.92 in Bitcoin to a cryptocurrency wallet controlled by Curry, according to CyberScoop. That figure is a long way from the $2.5 million Curry demanded, and it did not save him: Brightly reported the incident to law enforcement, and on 24 January 2024 the FBI searched Curry’s residence and seized electronic devices containing evidence linking him to the scheme.
Company response and a separate breach worth remembering
Brightly was measured in its public response. ‘We are aware of the U.S. Department of Justice’s (DOJ) convictions of Cameron Curry for extortion,’ the company said in a statement to BleepingComputer in March. ‘We have fully cooperated with the FBI and DOJ in this matter and appreciate their investigative efforts. Given that these proceedings are pending, we defer all questions to law enforcement authorities.’
It is worth noting that this is not the only data incident in Brightly’s recent history. In May 2023, the company disclosed a separate breach after attackers stole credentials and personal data from the database of its SchoolDude online platform. That incident affected nearly 3 million customers and users, with names, email addresses, account passwords and phone numbers all compromised. The two incidents are unrelated, but together they paint a picture of a company that has faced pressure from multiple directions in a short span.
For Curry, the sentencing closes the legal chapter. The case is a textbook example of an insider threat: an individual with legitimate, time-limited access who used it to exfiltrate data before the door closed, then bet on the leverage that stolen payroll information provides. He sent more than 60 extortion emails over roughly six weeks and walked away with $7,540.92 for his trouble, alongside a two-year prison sentence.
