Former Infrastructure Engineer Sentenced to 32 Months for Sabotaging and Extorting Former Employer

A Kansas City, Missouri, man has been sentenced to 32 months in federal prison following a sophisticated and calculated scheme to sabotage his former employer’s digital infrastructure and extort the company for a massive cryptocurrency payout. Daniel Rhyne, 59, who previously served as a core infrastructure engineer for an industrial firm based in Somerset County, New Jersey, orchestrated the attack in a bid to cripple the company’s operations from the inside.

The United States Department of Justice (DOJ) officially announced the sentencing, which marks the conclusion of a federal investigation into a high-stakes case of insider threat. Rhyne had previously entered a guilty plea to two serious federal charges: “extortion in relation to a threat to cause damage to a protected computer” and “intentional damage to a protected computer.” The sentencing, handed down by District Judge Michael A. Shipp in a Trenton, New Jersey, federal court, serves as a stark reminder of the unique vulnerabilities organizations face when trusted employees turn against the infrastructure they were hired to protect.

The victim firm is a significant player in the industrial sector, providing critical services across a diverse array of essential industries. Its portfolio spans aquaculture, biopharmaceuticals, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, manufacturing, and industrial processing, as well as metals, oil and gas, and the pulp and paper sectors. Given the breadth of these operations, the integrity of the company’s network is not merely a matter of administrative convenience but a necessity for the continuous function of complex industrial supply chains.

The sabotage took place in November 2023, utilizing the deep knowledge of the network that Rhyne possessed as an infrastructure engineer. By exploiting his administrative access, Rhyne placed a series of malicious scheduled tasks on the firm’s domain controller. These tasks were designed to execute with surgical precision, effectively paralyzing the company’s digital backbone.

The scope of the damage was extensive. The scheduled tasks were programmed to delete 13 domain administrator accounts, stripping the company of its ability to manage its own security and access protocols. Furthermore, the attack involved changing the passwords for 301 domain user accounts, two local administrator accounts impacting 254 servers, and two additional local administrator accounts affecting 3,284 individual workstations. The result was a near-total denial of service, rendering the firm unable to access its internal systems, critical data, and day-to-day operational tools.

To ensure the lockout remained effective, Rhyne chose a specific password for the compromised accounts: “TheFr0zenCrew!”. The scheduled tasks triggered late on the afternoon of November 25, 2023. Within less than an hour of the systems going dark, employees at the firm received a chilling communication from an external email address. The subject line, “Your Network Has Been Penetrated,” served as the opening salvo in an extortion attempt.

The message informed the company that its administrators had been locked out or deleted, and ominously claimed that all system backups had been erased. The extortionist threatened that unless a ransom was paid, 40 random servers would be permanently shut down each day for a ten-day period, a move that would have caused catastrophic and potentially irreversible damage to the company’s industrial operations. Rhyne demanded a payment of 20 bitcoin, which, at the time of the incident, was valued at approximately $750,000.

The firm’s response to the crisis proved to be a critical turning point. Rather than bowing to the extortionist’s demands or paying the ransom—a decision that aligns with the guidance often provided by federal law enforcement—the company initiated an immediate and robust internal forensic analysis. By scrutinizing network anomalies and correlating internal system logs with physical access records, the company’s IT security team began to construct a picture of how the breach occurred.

The investigation quickly transitioned from a private recovery effort to a federal criminal matter. The FBI became involved, leveraging the evidence provided by the firm to trace the unauthorized activity back to its source. Investigators successfully linked the malicious commands to a residential IP address located in Warren County, New Jersey. This digital trail, combined with the forensic logs, provided the evidence necessary for FBI Special Agent Timothy Lee to file a criminal complaint on August 8, 2024.

Following the filing of the complaint, authorities moved to take Rhyne into custody. By this time, Rhyne had relocated to Kansas City, Missouri. He was arrested there on August 27, 2024. The case proceeded through the federal court system in Trenton, where Rhyne eventually pleaded guilty on April 1, 2026. The 32-month prison sentence delivered in late September 2026 brings to a close a case that highlights the persistent threat of insider sabotage within the modern corporate landscape.

This case is part of a broader trend of high-profile cyber-related prosecutions handled by the Department of Justice. As organizations become increasingly digitized, the threat posed by individuals with authorized access—often referred to as “insider threats”—has become a primary concern for cybersecurity professionals and federal law enforcement alike. Unlike external hackers who must bypass perimeter defenses, an insider can often cause significant damage before alarms are triggered.

The successful prosecution of Rhyne underscores the efficacy of diligent forensic monitoring and the importance of immediate coordination with federal authorities when a breach occurs. In recent years, the DOJ has intensified its focus on prosecuting those involved in ransomware and extortion schemes, ranging from state-sponsored actors and international criminal syndicates to individuals working alone.

Other notable cases have included the sentencing of a former U.S. soldier who hacked major telecommunications providers, as well as the prosecution of individuals associated with notorious ransomware strains like Ryuk and Conti. In each instance, the government has sought to demonstrate that digital crimes, regardless of the sophistication of the technical obfuscation, will be met with severe legal consequences.

For the victimized firm in this case, the ordeal serves as a hard-learned lesson on the importance of robust internal controls, strict access management, and the necessity of having a prepared incident response plan that includes collaboration with law enforcement. While the financial and operational impact of such an attack is significant, the firm’s ability to avoid paying the ransom and its active participation in the subsequent investigation played a crucial role in bringing the perpetrator to justice. Rhyne, now facing his prison term, serves as a sobering example of the high cost of abusing professional trust for criminal gain.