Insider Threat Leads to Prison Sentence for Former Engineer
A Kansas City, Missouri man has been sentenced to 32 months in federal prison for his role in a cyber extortion plot targeting his former employer, an industrial firm headquartered in Somerset County, New Jersey. The U.S. Department of Justice announced the sentencing of Daniel Rhyne, who had previously pleaded guilty to two federal charges: 'extortion in relation to a threat to cause damage to a protected computer' and 'intentional damage to a protected computer'.
Role and Access Exploited in the Attack
Fifty-nine-year-old Daniel Rhyne had served as a core infrastructure engineer at the victim company, which provides critical services to a broad range of industries including aquaculture, biopharmaceuticals, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, manufacturing and industrial processing, metals, oil and gas, and pulp and paper. His position granted him elevated access to the firm’s internal systems, which he later abused to carry out the attack.
Details of the Sabotage Scheduled for November 2023
In November 2023, Rhyne placed scheduled tasks on the firm’s domain controller designed to disrupt operations and lock out legitimate administrators. These tasks were set to execute the following actions:
- Delete 13 domain administrator accounts
- Change passwords for 301 domain user accounts
- Change passwords for two local administrator accounts affecting 254 servers
- Change passwords for two additional local administrator accounts impacting 3,284 workstations
The password changes were uniformly set to 'TheFr0zenCrew!', a credential chosen to signal control over the compromised systems. The scheduled tasks were triggered in the late afternoon of November 25, 2023.
Ransom Demand and Victim Response
Within an hour of the tasks executing, employees began receiving emails from an external address with the subject line: 'Your Network Has Been Penetrated'. The message claimed that administrators had been locked out or deleted, all backups had been erased, and warned that unless a ransom was paid, 40 random servers would be shut down each day over a ten-day period.
Rhyne demanded a payment of 20 bitcoin, which was valued at approximately $750,000 at the time. There is no evidence that the victim firm complied with the demand. Instead, the company immediately launched an internal forensic investigation, analyzing network anomalies and correlating system logs with physical access records.
Investigation Leads to Arrest and Guilty Plea
The internal investigation was supplemented by the FBI, which traced the unauthorized activity directly to Rhyne’s residential IP address in Warren County, New Jersey. This digital evidence, combined with log analysis, provided the basis for FBI Special Agent Timothy Lee to file a criminal complaint on August 8, 2024.
Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, where he had relocated after leaving the company. He later pleaded guilty on April 1, 2026, in the U.S. District Court for the District of New Jersey in Trenton, before District Judge Michael A. Shipp.
Sentencing and Case Significance
On September 28, 2026, Rhyne was sentenced to 32 months in federal prison for his role in the sabotage and extortion scheme. The case underscores the persistent risk posed by insider threats, particularly when individuals with privileged access misuse their positions for financial gain through cyber extortion tactics.
Source: SecurityWeek