A North Carolina man has been convicted for extorting a D.C.-based technology company while working as a data analyst contractor. While the **Justice Department** press release didn't name the victim, court documents identify the company as **Brightly Software**, a Software-as-a-Service (SaaS) provider, previously known as SchoolDude, acquired by **Siemens** in August 2022. **Brightly**, with over 700 employees, provides asset management and maintenance software to over 12,000 clients globally. ## The Extortion Scheme According to the indictment, 27-year-old **Cameron Curry**, also known as "Loot," exploited his access to **Brightly's** payroll and corporate data to steal sensitive documents. He initiated the extortion scheme after learning his six-month contract would not be extended. One day after his contract ended on December 10, Curry allegedly sent over 60 extortion emails to **Brightly** employees using the [email protected] **Microsoft** email address and the Loot alias. He threatened to leak stolen sensitive information unless a $2.5 million ransom was paid. The extortion emails included screenshots of spreadsheets containing **Brightly** employees' Personally Identifiable Information (PII), such as names, dates of birth, home addresses, and compensation details. Curry also threatened to report the company to the **U.S. Securities and Exchange Commission (SEC)** for failing to disclose the data breach as legally required. "We will commence the process of disseminating salary information starting January 1,2024 in phases to all employees and will report you to the SEC after for not reporting the breach," Curry threatened. He further stated: "If you wish to reclaim your data, we recommend doing so promptly at 2.5 million USD in order to save your company and stocks, as each subsequent month will incur a $100,000 USD increase. Discrepancies in your books are currently over 16 million USD, posing a potential risk for retention issues, a hostile work environment, resentment, and more."  *Extortion email sample (Justice Department)* ## Investigation and Arrest **Brightly** paid $7,540 in Bitcoin to a cryptocurrency wallet controlled by Curry following the extortion attempts. The **FBI** raided Curry's residence on January 24 after the company reported the incident and seized electronic devices containing evidence of the scheme. Curry was released on bond in January 2024 and faces up to 12 years in prison for six counts of transmitting interstate communications with the intent to extort a victim company. ## Brightly's Response "We are aware of the U.S. Department of Justice’s (DOJ) convictions of Cameron Curry for extortion," **Brightly** told BleepingComputer. "We have fully cooperated with the FBI and DOJ in this matter and appreciate their investigative efforts. Given that these proceedings are pending, we defer all questions to law enforcement authorities." **Brightly** also notified customers of a separate data breach in May 2023, unrelated to this case. Attackers gained access to the database of its SchoolDude online platform, stealing credentials and personal data of nearly 3 million SchoolDude customers and users. The intrusion was discovered eight days after the initial breach on April 20. <a rel="noopener sponsored" href="https://hubs.li/Q043YRMg0"><img alt="tines" src="https://www.bleepstatic.com/c/p/red-report.jpg"></a> ## [Red Report 2026: Why Ransomware Encryption Dropped 38%](https://hubs.li/Q043YRMg0) Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight. Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.