A former infrastructure engineer was sentenced after locking thousands of devices on his employer’s network and demanding 20 bitcoin to stop the disruption. Prosecutors said Daniel Rhyne used an administrator account to remotely access the New Jersey industrial company’s network in November 2023, changed passwords, deleted 13 domain admin accounts, reset 301 user accounts, blocked access to 254 servers and 3,284 workstations, and sent a ransom email claiming backups had been deleted.
Why it matters: This is a notable insider-threat case showing how a trusted administrator can inflict ransomware-style damage without deploying malware. Organizations should review privileged access, monitor dormant or unusual admin activity, separate backup controls, and rapidly revoke access when employment issues arise.
Kevin Townsend
2026.10.10
99% relevant
This is the same underlying event and adds sentencing details, the defendant’s name, the 20 bitcoin demand, the November 2023 sabotage steps on the domain controller, and the FBI tracing of activity to his home IP address.
Sergiu Gatlan
2026.10.06
100% relevant
This article establishes a distinct story about the sentencing in a specific insider sabotage and extortion attack against an unnamed New Jersey industrial company.
← Back to all stories