Brightly contractor gets 2 years for insider extortion scheme
The sentence is two years on a 12-year max, and the opsec failures (family debit cards linked to the ransom wallet) are what collapsed the scheme.
TL;DR
Cameron Curry, a 27-year-old contractor at Siemens-owned Brightly Software, was sentenced to two years in prison for stealing employee payroll data and attempting to extort the company for $2.5 million. He received $7,540.92. Curry tied his mother's and sister's debit cards to the ransom Coinbase account, and the FBI identified him within weeks. He'd framed the extortion as a salary-transparency campaign across more than 60 threatening emails to executives.
The sentence lands at two years (far below the 12-year maximum) for a scheme that was both elaborate and operationally incompetent. Curry stole employee payroll and compensation data while employed as a contractor at the Siemens-owned asset management software firm, then fired off more than 60 extortion emails to executives over six weeks, framing the shakedown as a salary-transparency campaign.
He demanded roughly $2.5 million. He got $7,540.92.
The opsec was the undoing
Curry linked his mother's and sister's debit cards to the Coinbase account used for the ransom. The FBI identified him within weeks. The sentencing memorandum notes prosecutors initially misidentified Brightly's headquarters as Washington, D.C. rather than Cary, North Carolina, a venue error Curry's lawyers used to argue for a reduced sentence, citing 31 months of pretrial restraint including 17 months of home confinement.
The contractor access problem, again
The case fits a pattern that keeps surfacing: a contractor placed by a third-party staffing firm, handed a company laptop with broad data access, and insufficient controls to detect or prevent exfiltration over a four-month window. Curry stole the data between August and December 2023. Brightly didn't learn of the breach until the extortion emails began after his last day. The publicly traded parent notified the FBI on December 14, 2023.
For compliance and security teams at firms that rely on third-party staffing for data-sensitive roles, the operational takeaway isn't subtle: the background check is the floor, not the ceiling. Curry's post-employment access window and the use of a corporate device for bulk exfiltration went undetected until he announced himself.
Published ·Deep Fathom