Could this have been prevented?

Yes, implementing strict access controls, continuous monitoring, and regular audits could have identified and mitigated the unauthorized data access.

Insider Threat: North Carolina Tech Worker Convicted in $2.5M Data Extortion Case

A former contractor exploited access to sensitive data, leading to a significant extortion case and highlighting the critical need for robust internal security measures.

Published: March 20, 2026

Share this on:

Executive Summary

In December 2023, Cameron Curry, a 25-year-old contract employee from North Carolina, exploited his access to a Washington D.C.-based technology company's sensitive data. Upon learning his contract would not be renewed, Curry stole confidential employee information and, under the alias "Loot," sent over 60 emails threatening to publish the data unless a $2.5 million ransom was paid. The company reported the extortion to the FBI on December 14, 2023, and subsequently paid the ransom in January 2024. Curry was arrested on January 24, 2024, after authorities traced the extortion communications and cryptocurrency transactions back to him. He pleaded guilty to felony extortion on September 27, 2024, and faces sentencing on January 28, 2025. This incident underscores the significant risks posed by insider threats, especially when employees or contractors have access to sensitive information. Organizations must implement robust access controls, monitor for unusual activities, and foster a culture of security awareness to mitigate such risks.

Why This Matters Now

The rise in insider threats highlights the urgent need for organizations to strengthen internal security measures and employee monitoring to prevent data breaches and extortion attempts.

Attack Path Analysis

Cameron Curry, a contractor, exploited his authorized access to exfiltrate sensitive corporate data. He then used this data to extort his employer, demanding a ransom to prevent its public release. The company paid the ransom, but Curry's operational mistakes led to his identification and arrest.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

High

Lateral Movement

Mediuminferred

Command & Control

High

Exfiltration

Mediuminferred

Impact

High

Initial Compromise

Description

Curry, as a contractor, was granted legitimate access to the company's network and sensitive data.

Confidence:

High

MITRE ATT&CK® Techniques

Initial Access

T1078

Valid Accounts

Exfiltration

T1537

Transfer Data to Cloud Account

Exfiltration

T1052

Exfiltration Over Physical Medium

Exfiltration

T1041

Exfiltration Over C2 Channel

Discovery

T1087

Account Discovery

Exfiltration

T1567

Exfiltration Over Web Service

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Limit access to system components and cardholder data to only those individuals whose job requires such access.

Control ID: 7.2.1

The incident involved unauthorized access and exfiltration of sensitive employee data, indicating a failure to enforce access controls limiting data access to authorized personnel.

NYDFS 23 NYCRR 500 – Access Privileges

Control ID: 500.07

The breach resulted from inadequate management of access privileges, allowing a contractor to access and exfiltrate sensitive data beyond their authorized scope.

DORA – ICT Risk Management Framework

Control ID: Article 5

The organization's failure to prevent data exfiltration by an insider reflects deficiencies in its ICT risk management framework, particularly in identifying and mitigating insider threats.

CISA ZTMM 2.0 – Implement least privilege access controls and enforce strong authentication mechanisms.

Control ID: Identity and Access Management

The incident highlights the absence of least privilege access controls and strong authentication, enabling unauthorized data access and exfiltration by an insider.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Article 21

The organization's inability to prevent and detect the insider threat indicates non-compliance with required cybersecurity risk management measures, including access control and monitoring.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Information Technology/IT

Contractor insider threats targeting data analytics roles pose critical risks requiring enhanced zero trust segmentation and egress security controls.

Financial Services

Payroll data exfiltration exposes compensation inequities creating regulatory compliance risks under privacy frameworks and potential shareholder disclosure obligations.

Staffing/Recruiting

Third-party contractor placement creates accountability gaps in insider threat detection requiring enhanced vetting and continuous monitoring capabilities.

Legal Services

Employee compensation data breaches trigger class-action lawsuit risks and EEOC compliance violations requiring robust data loss prevention controls.

Sources

North Carolina tech worker found guilty of insider attack netting $2.5M ransomhttps://cyberscoop.com/cameron-curry-insider-attack-washington-tech-company/
Verified

North Carolina Man Pleads Guilty to Trying to Extort Millions of Dollars From D.C.-Based Companyhttps://www.justice.gov/usao-dc/pr/north-carolina-man-pleads-guilty-trying-extort-millions-dollars-dc-based-company

Verified

North Carolina Man Arrested for Trying to Extort Millions of Dollars from D.C.-Based Companyhttps://www.justice.gov/usao-dc/pr/north-carolina-man-arrested-trying-extort-millions-dollars-dc-based-company

Verified

Frequently Asked Questions

The incident revealed deficiencies in access controls and monitoring mechanisms, allowing a contractor to exfiltrate sensitive data without detection.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the contractor's ability to access, move laterally, and exfiltrate sensitive data, thereby reducing the potential impact of the breach.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The contractor's access to sensitive data would likely have been limited to only what was necessary for his role, reducing the risk of unauthorized data exposure.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The contractor's ability to access and aggregate sensitive employee data would likely have been constrained, reducing the scope of potential data collection.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The contractor's ability to move laterally within the network to access additional sensitive data would likely have been restricted, reducing the risk of widespread data access.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The contractor's ability to establish unauthorized communication channels for extortion purposes would likely have been detected and mitigated, reducing the effectiveness of such attempts.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The contractor's ability to exfiltrate sensitive data to external destinations would likely have been blocked, reducing the risk of data leakage.

Impact (Mitigations)

The financial and reputational damage resulting from the extortion could have been mitigated, reducing the overall impact on the company.

Impact at a Glance

Affected Business Functions

Human Resources
Legal Compliance
Public Relations

Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $2,500,000

Data Exposure

Personally identifiable information (PII) and compensation details of company employees.

Recommended Actions

• Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized data access.
• Utilize East-West Traffic Security to monitor and control internal communications, detecting unauthorized lateral movements.
• Deploy Egress Security & Policy Enforcement to restrict unauthorized data transfers to external destinations.
• Establish Multicloud Visibility & Control to gain comprehensive insights into data flows and detect anomalies.
• Conduct regular security awareness training to educate employees and contractors on data protection policies and insider threat risks.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

Insider Threat: North Carolina Tech Worker Convicted in $2.5M Data Extortion Case

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

MITRE ATT&CK® Techniques

Valid Accounts

Transfer Data to Cloud Account

Exfiltration Over Physical Medium

Exfiltration Over C2 Channel

Account Discovery

Exfiltration Over Web Service

Potential Compliance Exposure

PCI DSS 4.0 – Limit access to system components and cardholder data to only those individuals whose job requires such access.

NYDFS 23 NYCRR 500 – Access Privileges

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Implement least privilege access controls and enforce strong authentication mechanisms.

NIS2 Directive – Cybersecurity Risk Management Measures

Sector Implications

Information Technology/IT

Financial Services

Staffing/Recruiting

Legal Services

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads