A former core infrastructure engineer has been sentenced to 32 months in prison for sabotaging his own employer and then demanding a ransom to undo the damage.
The Justice Department says Daniel Rhyne, 59, of Kansas City, Missouri, had worked at an industrial firm headquartered in Somerset County, New Jersey, whose customers span manufacturing, energy, food production, healthcare, and biopharmaceuticals.
In November 2023, Rhyne planted scheduled tasks on the company’s domain controller. When they fired, they deleted 13 domain administrator accounts, reset passwords for 301 domain users, and changed local administrator credentials across 254 servers and 3,284 workstations. Most of the new passwords were set to the same string. The result was a firm locked out of its own systems and data.
Within an hour, staff received an email from an outside address with the subject line “Your Network Has Been Penetrated.” It claimed backups had been erased and warned that 40 servers would be shut down each day for ten days unless a payment was made. Rhyne sought roughly 20 bitcoin.
Rhyne had already pleaded guilty to extortion and intentional damage charges. The case is a reminder that privileged insiders with legitimate access remain one of the hardest threats to detect, because their actions look like administration until the moment they don’t.
