Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
A former industrial-firm engineer was sentenced to 32 months for sabotaging systems and demanding about $750,000 in bitcoin.
The U.S. Department of Justice said Daniel Rhyne, a former core infrastructure engineer at an unnamed New Jersey industrial firm, was sentenced to 32 months in federal prison. In November 2023 he scheduled tasks on a domain controller that deleted 13 domain administrator accounts and changed passwords for 301 users, two local admin accounts on 254 servers, and accounts affecting 3,284 workstations, often to “TheFr0zenCrew!”. An email then demanded 20 bitcoin, worth about $750,000, and threatened to shut down 40 servers a day. The firm did not pay; internal forensics and the FBI traced the activity to Rhyne, who pleaded guilty in April 2026.
- Daniel Rhyne was sentenced to 32 months for insider sabotage and extortion.
- Tasks deleted 13 domain admins and reset passwords on 254 servers and 3,284 workstations.
- He demanded 20 bitcoin, then about $750,000; the company did not pay.
- The FBI tied the activity to his home IP; he pleaded guilty in April 2026.
Full article446 words · extracted from securityweek.com · click to collapse
A Kansas City, Missouri man has been sentenced to 32 months in jail for crimes related to a ransom attack against his own company.
The DOJ has announced the sentencing of Daniel Rhyne. He had already pleaded guilty to ‘extortion in relation to a threat to cause damage to a protected computer’ and ‘intentional damage to a protected computer’.
Fifty-nine-year-old Rhyne had been a core infrastructure engineer at an industrial firm headquartered in Somerset County, New Jersey. The firm provides services to industries involved in aquaculture, biopharmaceuticals, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, manufacturing and industrial processing, metals, oil and gas, and pulp and paper.
In November 2023, Rhyne placed scheduled tasks on the firm’s domain controller that would delete 13 domain administrator accounts; change passwords to 301 domain user accounts; change passwords to two local administrator accounts that would impact 254 servers; and change passwords to two local administrator accounts impacting 3,284 workstations. The effect was to deny the firm access to its systems and data.
Where passwords were changed, it was generally to ‘TheFr0zenCrew!’.
The scheduled tasks were completed late afternoon on November 25. Within an hour, certain employees received an e-mail from an external address. The subject line said, “Your Network Has Been Penetrated”. It warned that administrators had been locked out or deleted, all backups had been deleted, and that, unless a ransom was paid, 40 random servers would be shut down each day over a ten-day period.
Advertisement. Scroll to continue reading.
Rhyne was demanding a payment of 20 bitcoin, worth at the time approximately $750,000.
There is no suggestion that the victim firm paid any ransom. Rather, it immediately started its own internal forensic analysis of any network anomalies, and it correlated internal logs with physical access records. It involved the FBI, which tracked the unauthorized activity directly to Rhyne’s residential IP address in Warren County, New Jersey.
This joint forensic investigation provided sufficient evidence for FBI Special Agent Timothy Lee to file a criminal complaint on August 8, 2024, leading to Rhyne’s arrest on August 27, 2024, in Kansas City, where he had subsequently moved. He pleaded guilty on April 1, 2026, in federal court in Trenton, New Jersey, before District Judge Michael A. Shipp.
Rhyne was sentenced on September 28, 2026, to 32 months in federal prison for his role in the sabotage and extortion plot.
Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon
Related: US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Related: Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison
Related: Two Scattered Spider Hackers Sentenced to Jail in UK