Ex-infrastructure engineer Daniel Rhyne gets 32 months for locking his New Jersey employer out of thousands of devices and demanding 20 bitcoin
The US Attorney's Office for the District of New Jersey announced on 5 October 2026 that Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on 28 September to 32 months in prison. He had pleaded guilty on 1 April 2026 to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. Rhyne was a core infrastructure engineer at a US industrial company headquartered in New Jersey. In November 2023 he used unauthorised remote desktop sessions and scheduled tasks on the domain controller to delete network administrator accounts, change passwords on other accounts and shut down servers, then on 25 November 2023 emailed staff threatening to keep shutting down servers unless he was paid about 20 bitcoin (then about US$750,000). BleepingComputer, citing the criminal complaint, reports the tasks deleted 13 domain admin accounts, reset 301 domain user passwords, and locked staff out of 254 servers and 3,284 workstations, and that the ransom email claimed backups had been deleted. Investigators traced searches for the commands he used to a hidden virtual machine and his work laptop. Primary: BleepingComputer (6 Oct) and the DOJ District of New Jersey releases.
- Product
- Windows Active Directory domain (insider misuse of administrator access)
- Versions
- n/a — insider incident; no CVE or product flaw
- Exploited in Australia?
- no
- Patch to
- Treat privileged insiders as a threat model: separate admin accounts from daily accounts, use just-in-time access for domain admin, and alert on new or changed scheduled tasks on domain controllers, mass password resets and deletion of admin accounts. Keep offline or immutable backups, and remove access quickly and completely when staff leave or are under investigation.
Primary: BleepingComputer — Engineer sentenced for locking over 3,000 devices on employer network (6 Oct 2026) · Vendor: US DOJ, District of New Jersey — Former employee of national industrial company pleads guilty (Apr 2026; sentencing release 5 Oct 2026)