Former Engineer Sentenced to Prison for Insider Extortion Plot Against Industrial Firm
A former core infrastructure engineer has been sentenced to 32 months in prison for orchestrating an insider cyber extortion scheme against his former employer, an industrial firm.
A Kansas City, Missouri man, Daniel Rhyne, has been sentenced to 32 months in federal prison for his role in a sophisticated cyber extortion plot against his former employer. Rhyne, 59, a former core infrastructure engineer at an industrial firm headquartered in Somerset County, New Jersey, pleaded guilty to charges of extortion and intentional damage to a protected computer.
The incident, which occurred in November 2023, saw Rhyne leverage his privileged access to sabotage the company's network. He scheduled tasks on the firm's domain controller designed to delete 13 domain administrator accounts, change passwords for 301 domain user accounts, and alter credentials for local administrator accounts impacting hundreds of servers and thousands of workstations. The password for many accounts was changed to "TheFr0zenCrew!".
Following the execution of these tasks, which effectively locked out legitimate administrators and disrupted operations, an external email was sent to employees. This email, with the subject line "Your Network Has Been Penetrated," claimed that administrators were locked out, all backups were deleted, and threatened to shut down 40 random servers daily over ten days unless a ransom of 20 bitcoin, then valued at approximately $750,000, was paid.
The victim firm, which provides services across a wide array of industries including biopharmaceuticals, oil and gas, and manufacturing, did not pay the ransom. Instead, the company initiated an internal forensic analysis, correlating network logs with physical access records. This investigation, alongside the FBI's tracking of the unauthorized activity to Rhyne's residential IP address, provided the evidence needed to pursue criminal charges.
Special Agent Timothy Lee of the FBI filed a criminal complaint on August 8, 2024, leading to Rhyne's arrest in Kansas City on August 27, 2024. Rhyne subsequently pleaded guilty in federal court in Trenton, New Jersey, on April 1, 2026, before District Judge Michael A. Shipp.
The sentencing underscores the significant threat posed by malicious insiders who possess deep technical knowledge and privileged access to critical systems. Such individuals can inflict substantial damage and disruption, often with the intent of financial gain through extortion.
This case serves as a stark reminder for organizations to implement robust insider threat detection programs, enforce strict access controls, and conduct regular security audits. The ability to quickly detect and respond to anomalous activity, as demonstrated by the victim firm and the FBI, is crucial in mitigating the impact of such attacks and bringing perpetrators to justice.
While the specific industrial firm was not named in the court documents, its broad service portfolio highlights the potential ripple effects of such an attack across multiple vital sectors of the economy. The incident also emphasizes the importance of comprehensive backup strategies and recovery plans, even though the attackers claimed to have deleted all backups.