A former contractor for Brightly Software, Cameron Nicholas Curry, has been sentenced to two years in prison for an insider attack that involved data theft and extortion. Curry, also known as "Loot," was found guilty of six counts of extortion in March and received his sentence in August. Following his prison term, he will serve one year of supervised release.
Curry, a 27-year-old North Carolina resident, worked as a data analyst contractor for Brightly Software, an asset and maintenance management software provider owned by Siemens. His contract spanned from August to December 2023. During this period, he accessed the company's network and exfiltrated a significant amount of corporate data, including sensitive employee and compensation information.
Immediately after his last day of employment, Curry began sending threatening emails to Brightly Software employees and executives. Over a six-week period in late 2023 and early 2024, he sent more than 60 emails, demanding a ransom to prevent the leak and destruction of the stolen data. His initial demand was approximately $2.5 million.
In his communications, Curry threatened to disclose the company's payroll data, claiming it revealed significant pay inequity among the workforce. He attached screenshots of spreadsheets containing personally identifiable information of employees to some emails. He also warned he would provide instructions to employees on how to pursue pay discrimination claims through mediation, the Equal Employment Opportunity Commission, or a class-action lawsuit. Some threats were highly specific, such as a claim about a legal team member not receiving a bonus while many high-level employees did. Curry further threatened to report the data breach to the Securities and Exchange Commission, citing disclosure requirements for public companies.
Brightly Software, which is publicly traded, notified the FBI of the breach on December 14, 2023. In late January 2024, the company paid a sum of $7,540.92, which was less than one percent of Curry's initial ransom demand.
Authorities were able to identify and build a case against Curry relatively quickly due to several operational security errors he made. He used a Coinbase account for the ransom, which was established with personal and verifiable data, and linked two debit cards belonging to his mother and sister to the account. Weeks after the ransom payment, the FBI searched Curry's apartment, digital devices, and vehicle in Charlotte, North Carolina.
Curry's legal team argued that the case was prolonged due to prosecutorial errors, including affidavits that incorrectly stated Brightly Software's headquarters were in Washington, D.C. While Siemens' U.S. corporate headquarters are in Washington, Brightly Software is based in Cary, North Carolina. This discrepancy led to a change in trial venue and, according to Curry's lawyers, resulted in an unnecessarily lengthy pretrial restraint of nearly 31 months, including 17 months of full home confinement.
Brightly Software was identified as the victim in court records filed in the U.S. District Court for the Western District of North Carolina. The company has not publicly commented on the incident.
