Former Infrastructure Engineer Sentenced to 32 Months for Orchestrating Ransomware Attack Against Employer

A Kansas City, Missouri, man has been sentenced to 32 months in federal prison for orchestrating a sophisticated cyberattack against his own employer, a high-stakes industrial firm based in Somerset County, New Jersey. The sentencing, announced by the Department of Justice, brings a definitive conclusion to a case that highlights the significant risks posed by "insider threats"—employees who leverage their intimate knowledge of a company’s architecture to cause catastrophic operational disruption.

Fifty-nine-year-old Daniel Rhyne, who previously served as a core infrastructure engineer for the unnamed firm, faced federal charges for his role in the digital sabotage. Rhyne had previously entered a guilty plea to two serious counts: extortion in relation to a threat to cause damage to a protected computer, and intentional damage to a protected computer. The sentence, handed down by District Judge Michael A. Shipp in Trenton, New Jersey, on September 28, 2026, serves as a stark reminder of the legal consequences awaiting those who weaponize their technical access against their own organizations.

The firm targeted by Rhyne is no small operation; it is a critical player in the industrial sector, providing specialized services to a wide array of vital industries. Its client base spans sectors ranging from biopharmaceuticals, chemistry, and healthcare to food and beverage production, hydrogen mobility, and oil and gas processing. By attacking the internal systems of such a firm, Rhyne did not merely target a business; he threatened the continuity of processes that underpin essential supply chains across multiple industries.

The mechanics of the attack were as precise as they were destructive. In November 2023, Rhyne utilized his administrative privileges to plant "logic bombs"—scheduled tasks designed to execute automatically on the company’s domain controller. The objective was to paralyze the firm’s digital infrastructure from the inside out. Specifically, the tasks were programmed to delete 13 critical domain administrator accounts, effectively locking out the company’s IT security team from their own governance tools. Furthermore, the tasks were set to alter the passwords for 301 domain user accounts, two local administrator accounts impacting 254 servers, and two additional local administrator accounts governing 3,284 workstations.

The sheer scale of the disruption was staggering. By changing these credentials—most often to the mocking password "TheFr0zenCrew!"—Rhyne effectively incapacitated the entire network. The company’s ability to manage its servers, access its data, and maintain its operational workflows was severed almost instantaneously when the scheduled tasks completed their execution in the late afternoon of November 25, 2023.

The extortion element of the crime unfolded within an hour of the network collapse. Employees across the firm received an alarming email from an external address bearing the subject line, "Your Network Has Been Penetrated." The message served as a digital ultimatum, informing the firm that its administrators had been locked out, its backups had been systematically destroyed, and its systems were now under the control of an attacker. The threat was explicit: unless a ransom of 20 bitcoin—valued at approximately $750,000 at the time—was paid, the attacker would remotely shut down 40 random servers each day over the course of a ten-day period.

Despite the pressure of the threat, the victim firm maintained its composure and refused to yield to the extortion demands. Rather than negotiating with the assailant, the company initiated an immediate internal forensic investigation. This process was methodical and swift, involving the correlation of internal system logs with physical access records. The firm’s security team, acting in concert with the Federal Bureau of Investigation, began to peel back the layers of the digital assault.

The forensic trail, however, did not lead to a sophisticated foreign syndicate, but rather back to the firm’s own internal architecture. FBI investigators were able to trace the unauthorized activity directly to an IP address located in Warren County, New Jersey, which was identified as Rhyne’s residential connection. This critical breakthrough provided the evidence necessary for FBI Special Agent Timothy Lee to file a criminal complaint on August 8, 2024. Following the filing, Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, where he had relocated following his departure from the firm.

The legal proceedings moved forward in federal court in Trenton, New Jersey, where Rhyne eventually entered his guilty plea on April 1, 2026. Throughout the investigation and subsequent prosecution, the case served as a high-profile example of the challenges inherent in securing corporate networks against the very people entrusted to maintain them. Unlike external threats, which often rely on social engineering or software vulnerabilities to gain initial access, an insider like Rhyne possesses the keys to the kingdom. His ability to deploy scheduled tasks on the domain controller underscores the necessity for companies to implement strict "least privilege" access models, where even senior engineers are subject to dual-authorization requirements for critical system changes.

The sentencing of Rhyne to 32 months in prison is part of a broader, ongoing effort by the Department of Justice to deter cybercrime and punish those who disrupt critical infrastructure. As cyber-attacks become more frequent and the methods of extortion more refined, the federal government has increasingly focused on the role of individual actors in these schemes.

Rhyne’s case is far from an isolated incident. In recent years, federal courts have seen a steady stream of cases involving malicious insiders, rogue contractors, and international hacking groups. These include the sentencing of a former U.S. soldier for hacking major telecommunications providers, the prosecution of individuals associated with the notorious Ryuk ransomware group, and the sentencing of developers linked to the Conti ransomware syndicate. Furthermore, the recent legal actions against individuals involved in "Scattered Spider" hacking operations demonstrate that whether the perpetrator is an overseas criminal or a domestic employee, the reach of federal law enforcement is extensive.

The 32-month sentence for Rhyne represents a significant penalty for the breach of trust and the endangerment of the firm’s operations. As the victim company continues to move past the incident, the case remains a sobering case study for the cybersecurity community. It emphasizes that the most significant threat to a network’s integrity is often found within the very organization that it is designed to protect. For the industrial firm, the decision to involve the FBI and conduct a rigorous internal audit allowed them to identify the perpetrator, preserve their operations, and ensure that justice was served without capitulating to the demands of a criminal actor. The case concludes with Rhyne now serving his time, while the incident stands as a warning to other insiders who might consider using their technical expertise for illicit gain.