Terminated contract led to $2.5 million cyber extortion scheme