A contractor's six-month deal lapsed. The next day, a $2.5 million demand arrived

A former data analyst contractor at Brightly Software has been sentenced to two years in prison for a $2.5 million extortion scheme against the company that had just declined to extend him ^[3]. The timeline is the part worth copying into your own runbook: the six-month contract ended on December 10, and the first extortion email went out one day later ^[1][7].

Cameron Curry, 27, of North Carolina, operating as "Loot," was found guilty in March ^[5][6]. According to court documents cited by BleepingComputer, he stole sensitive documents after gaining access to Brightly's payroll information and corporate data, then used them to extort the company after learning his contract would not be extended ^[1]. Between December 11, 2023 and January 24, 2024 he emailed dozens of Brightly employees from lootsoftware@outlook.com demanding $2.5 million in cryptocurrency ^[7]. That is a 45-day campaign against the company's own staff ^[14].

The messages were built to create internal pressure rather than technical fear. One threatened to begin "disseminating salary information starting January 1, 2024 in phases to all employees" and to report the company to the SEC for not disclosing the breach ^[8]. Another set the price at $2.5 million with a $100,000 monthly escalation, roughly four percent a month ^[9][15], and asserted that "discrepancies in your books are currently over 16 million USD" ^[9]. He attached screenshots of employee personally identifiable information including names, dates of birth, home addresses and compensation ^[10], and threatened the SEC referral over the undisclosed breach ^[11].

Brightly paid $7,540 in Bitcoin to a wallet Curry controlled ^[2], about three tenths of one percent of the demand ^[16] and under eight percent of a single month's escalation ^[17]. The company then reported the incident to law enforcement, and the FBI searched Curry's residence on January 24 and seized devices linking him to the scheme ^[18]. Brightly told BleepingComputer in March that it had fully cooperated with the FBI and DOJ and was deferring questions to law enforcement ^[12].

Read as an access-control story, this case is unremarkable. Brightly employs over 700 people and serves more than 12,000 clients ^[4]; a data analyst who can reach payroll and corporate records is doing the job as scoped. Nothing in the reported record establishes when the copying happened relative to the non-renewal decision, and nothing suggests the extortion required continued access: the emails came from a consumer Outlook account, and the data was already out ^[7][1]. That is the uncomfortable part. A privileged-access review answers who can reach payroll today. It does not answer who reached payroll last month and has just been told there is no month seven.

The window that matters opens when the renewal decision is made and closes when the engagement ends, and in most organisations that window is managed by a procurement calendar rather than by security. A non-renewal is not a termination, so it usually generates no incident, no interview, no review of what the departing account has recently exported. The contract simply runs down while the person knows it is running down.

Watch whether renewal and non-renewal decisions get routed to security as triggering events, with data-egress review over the notice period rather than a badge-off checklist on the last day. Watch also how the SEC-referral threat performs as extortion leverage now that it has been tried: Brightly had separately disclosed a breach in May 2023 involving nearly 3 million SchoolDude customers and users ^[13], so the threat was aimed at a company with a public disclosure history.