News Date: 2026-10-10
A former core infrastructure engineer has been sentenced to 32 months in federal prison after using his privileged access to disrupt an industrial company's network and launch an extortion attempt against his own employer.
Daniel Rhyne previously pleaded guilty to computer damage and extortion-related charges. According to the case, he created scheduled tasks on the company's domain controller in November 2023. Those tasks were designed to delete 13 domain administrator accounts, change passwords for 301 domain users and modify local administrator credentials affecting hundreds of servers and thousands of workstations.
Administrative knowledge became the attack tool
The sabotage was followed by an external email claiming the network had been penetrated. Employees were warned that servers would be shut down unless the company paid 20 bitcoin, worth roughly $750,000 at the time.
The organization did not simply treat the incident as an ordinary ransomware attack. Its investigators compared network logs with physical access records and involved the FBI. Investigators ultimately connected unauthorized activity to Rhyne's residential internet address. He was arrested in August 2024, pleaded guilty in April 2026 and was sentenced on September 28, 2026.
I believe this case is a useful reminder that insider risk cannot be addressed only by employee monitoring software. The more fundamental question is whether one administrator can create destructive domain-level automation without independent approval or immediate detection.
Controls that could reduce the damage
- Require privileged access management for domain and local administrator credentials.
- Use separate administrative accounts for routine work and high-impact changes.
- Alert on scheduled tasks created or modified on domain controllers.
- Protect security logs by forwarding them to systems administrators cannot alter.
- Require dual authorization for bulk password resets, account deletion and backup changes.
- Maintain tested break-glass accounts and offline recovery procedures.
Behavior analytics can help identify unusual administrator actions, but technical controls should not depend on guessing an employee's intentions. Privilege should be temporary, tightly scoped and recorded in a tamper-resistant system.
In my view, the company's decision to correlate digital evidence with physical records was particularly important. Insider investigations often become stronger when identity, endpoint, network and building-access information are examined together. Organizations should design that visibility before an incident rather than attempting to assemble it during an extortion crisis.