A man from North Carolina has been found guilty of trying to get money from a technology company located in Washington, D.C., while he was working there as a contractor analyzing data.

Although the Justice Department’s announcement didn’t name the company, legal documents show it was Brightly Software, a SaaS company previously known as SchoolDude, which Siemens bought in August of 2022.

Brightly has been operating for over 20 years, employs more than 700 people, and offers software for managing assets and maintenance to over 12,000 customers worldwide, primarily in the United States, Canada, the United Kingdom, and Australia.

According to the indictment, Cameron Curry, 27, also known as “Loot,” exploited his access to Brightly’s payroll information and company data to steal confidential documents. He later used these documents to try to extort the company after learning his six-month contract would not be renewed.

The day after his contract ended on December 10, Curry started sending over 60 threatening emails to Brightly employees, using the email address [email protected] and the name “Loot.” He threatened to release sensitive information stolen between August and December 2023 unless he was paid $2.5 million.

In his extortion emails, Curry included screenshots of spreadsheets containing Brightly employees’ personal information, such as names, birthdates, addresses, and salaries. He also threatened to report the company to the SEC for not reporting the data breach as required.

“We will begin releasing salary information to all employees in stages starting January 1, 2024, and will then report you to the SEC for not disclosing the breach,” Curry wrote in one email.

“If you want your data back, we suggest paying $2.5 million USD promptly to protect your company and stock value. Each following month the price will increase by $100,000 USD. There are currently over $16 million USD in accounting discrepancies, which could lead to retention problems, a negative work environment, resentment, and more.”

Following Curry’s numerous demand emails, Brightly paid $7,540 in Bitcoin, which was sent to a cryptocurrency wallet that Curry controlled.

After the company reported the incident, the FBI searched Curry’s home on January 24 and found electronic devices containing evidence of his extortion plan.

Curry was released on bond in January 2024 and could face up to 12 years in prison for six counts of sending or causing interstate communication with the intent to extort the company.

Brightly also informed customers about a separate data breach in May 2023. Attackers had accessed the SchoolDude platform database and stolen login information and personal data (including names, email addresses, passwords, and phone numbers).

Information submitted to the Maine Attorney General’s office revealed that the intrusion was discovered 8 days after the attackers entered Brightly’s systems on April 20, and that almost 3 million SchoolDude customers and users were affected by the data breach.