A contractor at Brightly Software (owned by Siemens) used his legitimate access to steal sensitive employee and corporate data, then tried to extort the company for $2.5 million. Using the alias “Loot,” he sent dozens of threatening emails and attached screenshots of payroll-style spreadsheets to prove he had the data, demanding payment in cryptocurrency.
A data analyst working as a contractor at Brightly Software, owned by Siemens, learned that his contract would not be renewed. Rather than simply departing, he used his legitimate access to copy sensitive corporate records, including employee payroll data containing names, home addresses, dates of birth, and salary information. He then adopted an online alias, "Loot," and began an extortion campaign against the company.
Over several weeks between December 2023 and January 2024, he sent more than 60 emails to employees and executives demanding a cryptocurrency payment of $2.5 million. To prove he had real data, he attached screenshots of the stolen spreadsheets directly to his messages. He escalated pressure by threatening to increase the ransom by $100,000 every month the demand went unpaid, and by threatening to report the company to the SEC over an alleged undisclosed breach and to expose internal pay disparities.
This was not a technical hacking exercise. It succeeded because the attacker already had authorized access to the systems and data he later weaponized. The exploitation happened at the human and process level rather than through malware or a compromised credential. Because the access existed before the contract ended, the theft could occur before anyone thought to revisit or restrict his permissions.
The extortion emails themselves relied on classic social engineering pressure: urgency created by escalating financial demands, credibility created by attached proof, and coercion amplified by threats of regulatory exposure and reputational damage.
Extortion attempts like this should be treated immediately as a security incident rather than a negotiation. Employees and executives who receive such emails should avoid engaging with the sender, preserve all evidence, and escalate directly to security and legal teams.
Insider risk is often highest during offboarding. Access to sensitive systems and data should be revoked as soon as a departure, whether voluntary or involuntary, becomes known, and unusual access patterns should be monitored closely from that point forward.
Finally, training for executives, HR, finance, and legal teams should specifically cover coercion tactics such as escalating deadlines, cryptocurrency payment demands, and threats of regulatory exposure, since recognizing these tactics early can prevent panic-driven decisions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It occurs when someone with legitimate access to company systems, such as an employee or contractor, uses that access to steal sensitive data and then threatens to release it publicly unless paid.
The individual retained access to sensitive payroll and employee data after learning his contract would not be renewed, giving him the opportunity to exfiltrate records before access was revoked.
Treat it as a security incident immediately by not engaging with the sender, preserving all evidence, and escalating to security and legal teams rather than negotiating directly.
Revoke system access immediately when a contractor or employee's departure is known, and closely monitor data access at the point someone learns they may be leaving.
Imagine this email: “I have your payroll data. Pay $2.5 million in crypto or I’ll publish it.” That actually happened. At Brightly Software, a contractor lost his job, kept his access, stole payroll spreadsheets, then, as “Loot,” fired off 60 extortion emails demanding crypto. His pressure tactic? Attach screenshots of real-looking payroll spreadsheets and threaten to raise the ransom by $100,000 every month and report the company to the SEC. If you ever see an email like this, don’t reply, don’t pay. Stop and forward it immediately to Security and Legal as an extortion incident.
A sextortion email campaign is using real leaked email addresses from ShinyHunters-related data dumps to make threats sound credible. The scammers impersonate the “ShinyHunters hacking group,” claim they recorded victims via webcam, and demand $2,000 in Bitcoin within 48 hours. Reporting indicates…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Researchers showed that an attacker can hide instructions inside an Azure DevOps pull request description so an AI coding agent follows the attacker’s directions instead of the reviewer’s. Because the agent acts with the reviewer’s permissions, it can access other projects and leak sensitive…
A suspected North Korean IT worker allegedly got hired by Consensys (MetaMask’s parent) using an alias and contributed to MetaMask’s core wallet code for about a month. The person was later removed, and Consensys says an investigation found no stolen assets, no data theft, and no malicious code…
A criminal actor calling itself “Ransom Busters” is emailing organizations that recently suffered ransomware incidents, claiming it hacked ransomware groups’ servers and can delete the victim’s stolen data for a $20,000–$60,000 fee. The messages ask to speak with the CEO or IT leadership and…
Researchers say the BlackFile extortion group is actively targeting large financial and other organizations using voice-phishing calls where attackers impersonate IT support to get initial access. Victims are then pressured with multimillion-dollar extortion demands and, in some cases, escalations…
