Former Infrastructure Engineer Sentenced to 32 Months for Ransomware Sabotage of Former Employer

A Kansas City, Missouri man has been sentenced to 32 months in federal prison for orchestrating a sophisticated cyber-sabotage and extortion campaign against his own former employer. The sentencing, announced by the Department of Justice, marks the conclusion of a case that highlights the significant risks posed by "insider threats"—individuals who leverage their specialized knowledge and administrative access to inflict calculated damage on the organizations they once served.

Daniel Rhyne, 59, previously pleaded guilty to charges of extortion related to a threat to cause damage to a protected computer, as well as intentional damage to a protected computer. The sentencing, delivered by District Judge Michael A. Shipp in Trenton, New Jersey, brings a definitive end to a legal saga that began following a series of disruptive events in late 2023.

A Breach from Within

At the time of the incident, Rhyne served as a core infrastructure engineer for a prominent industrial firm headquartered in Somerset County, New Jersey. The company operates as a critical service provider across a diverse array of sectors, including biopharmaceuticals, aquaculture, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, and industrial processing, as well as the metals, oil and gas, and paper industries. Given the nature of these sectors, the firm’s digital infrastructure is inherently complex and essential to daily operations, making it an attractive target for disruption.

The internal assault began in November 2023, when Rhyne utilized his administrative privileges to plant "logic bombs" in the form of scheduled tasks on the firm’s domain controller. The scale of the intended damage was massive. The scheduled scripts were designed to delete 13 critical domain administrator accounts, effectively stripping the company of its ability to manage its own network. Furthermore, the tasks were programmed to overwrite passwords for 301 domain user accounts, two local administrator accounts impacting 254 servers, and two additional local administrator accounts affecting 3,284 workstations.

The choice of password for the compromised accounts was "TheFr0zenCrew!", a moniker that served as a signature for the malicious activity. By executing these changes, Rhyne effectively locked the firm out of its own digital ecosystem, paralyzing its ability to access essential systems and proprietary data. The scheduled tasks were triggered late in the afternoon on November 25, 2023, setting off a rapid-fire sequence of network failures.

The Extortion Attempt

Within an hour of the network lockdown, employees at the firm received an ominous email from an external address. With a subject line reading "Your Network Has Been Penetrated," the message served as a formal ransom demand. The email explicitly detailed the scope of the damage, informing the company that its administrators had been locked out, its domain controllers compromised, and—most alarmingly—that all backups had been systematically deleted.

The extortionist threatened that, unless a ransom payment was met, 40 random servers would be permanently shut down each day over a ten-day period, effectively crippling the firm’s ability to conduct business. The demand was set at 20 bitcoin, which, at the time of the incident, was valued at approximately $750,000.

In many cases, such a scenario creates a state of panic for a business. However, the victim firm opted for a strategy of containment and investigation rather than compliance. There is no indication that the company ever considered paying the ransom. Instead, they immediately initiated a rigorous internal forensic analysis, meticulously correlating internal network logs with physical access records. This diligent approach allowed the company to quickly identify that the anomalous activity originated from an internal source rather than an external advanced persistent threat (APT) group.

Forensic Investigation and Prosecution

The firm’s swift collaboration with the FBI was instrumental in the case. By providing federal investigators with access to internal data, the company helped authorities trace the malicious activity directly to an IP address in Warren County, New Jersey, which was identified as Rhyne’s residential connection at the time.

The weight of the forensic evidence compiled during the joint investigation provided the necessary grounds for FBI Special Agent Timothy Lee to file a formal criminal complaint on August 8, 2024. Following this, Rhyne, who had since relocated to Kansas City, Missouri, was taken into custody on August 27, 2024.

The legal process moved through the federal court system in New Jersey, where Rhyne eventually entered a plea of guilty on April 1, 2026. The 32-month prison sentence handed down by Judge Shipp on September 28, 2026, serves as a stark reminder of the consequences for employees who weaponize their technical access against their employers.

The case underscores a growing trend in cybersecurity where the most dangerous threats are not necessarily from anonymous hackers in foreign countries, but from those who possess the "keys to the kingdom." As companies continue to digitize their industrial processes, the vetting and monitoring of privileged access—even for long-term employees—remains a top priority for security professionals.

This sentencing is part of a broader series of legal actions taken by the Department of Justice against individuals involved in cybercrime and extortion schemes. Recent years have seen significant prison sentences handed down for various types of digital sabotage, including cases involving former military personnel, ransomware developers, and members of organized hacking collectives such as "Scattered Spider." These convictions underscore a unified federal effort to curb the rise of digital extortion and hold perpetrators accountable for the systemic damage they inflict upon both private and public infrastructure.