Cameron Curry, a data analyst at Brightly Software (acquired by Siemens), exploited his legitimate access to sensitive employee and corporate data after learning his contract would not be renewed. He exfiltrated PII, payroll, and internal records, then sent over 60 extortion emails under the alias "Loot" demanding $2.5 million in cryptocurrency, threatening to leak data and report the company to the SEC. Investigators traced the extortion to Curry through email metadata and links to Coinbase accounts connected to his family. He was convicted on six counts of transmitting interstate communications with intent to extort and sentenced to 24 months in federal prison plus supervised release and restitution. The incident underscores the risk of insider threats during the window between notification of termination and access revocation.

The impact was primarily reputational and operational for Brightly Software, involving exposure of sensitive employee PII and payroll data. The extortion attempt could have led to significant financial loss if the ransom had been paid in full. The incident demonstrates the risk posed by trusted insiders with legitimate access who misuse data before losing access. No external hacking or exploitation was involved, but the insider's actions caused legal and financial consequences for both the individual and the company.

The key mitigation is immediate revocation of access rights upon notification of contract non-renewal or termination to prevent data exfiltration by disgruntled insiders. Organizations should implement strict offboarding procedures that include disabling credentials and monitoring for unusual data access during the employee exit window. Since this incident involved no technical exploit, focusing on access control and insider threat detection is critical. No patch or technical fix applies. Awareness and training on insider threat risks and rapid response to suspicious activity are recommended.