A Kansas City, Missouri, man has been sentenced to 32 months in federal prison following a calculated and malicious cyberattack against his own former employer. Daniel Rhyne, 59, orchestrated a sophisticated sabotage operation that crippled the industrial firm’s digital infrastructure, attempting to extort the company for a massive ransom payment in cryptocurrency. The sentencing, handed down by U.S. District Judge Michael A. Shipp in Trenton, New Jersey, brings a formal conclusion to a case that highlights the significant risks posed by "insider threats"—employees who leverage their intimate knowledge of a company’s security architecture to inflict maximum damage.
The Department of Justice confirmed the sentencing of Rhyne, who had previously entered a guilty plea to two serious federal charges: extortion in relation to a threat to cause damage to a protected computer, and intentional damage to a protected computer. The proceedings in federal court marked the end of a high-stakes investigation that involved federal authorities tracing the digital fingerprints of a disgruntled employee who sought to profit from the disruption of a vital industrial entity.
Rhyne had served as a core infrastructure engineer for an industrial services firm headquartered in Somerset County, New Jersey. The company operates as a critical service provider across a vast array of sectors, including biopharmaceuticals, aquaculture, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, manufacturing, industrial processing, metals, oil and gas, and the pulp and paper industry. Given the firm’s reach into these essential supply chains, the sabotage of its network had the potential to create cascading disruptions across multiple critical national industries.
The attack, which unfolded in late November 2023, was not a result of an external breach but a deliberate, scheduled internal sabotage. Rhyne utilized his administrative privileges to plant malicious tasks within the firm’s domain controller. These tasks were designed to execute with surgical precision, effectively paralyzing the company’s ability to conduct business. The scope of the damage was extensive: the script was programmed to delete 13 critical domain administrator accounts, thereby stripping the company of its ability to manage its own network. Furthermore, the attack forced password resets on 301 domain user accounts, two local administrator accounts impacting 254 servers, and two additional local administrator accounts affecting 3,284 workstations.
The sheer scale of the lockout left the firm’s operations in a state of total suspension. In a brazen display of the perpetrator’s intent, the password chosen for the newly locked accounts was set to “TheFr0zenCrew!”—a mocking identifier that underscored the malicious nature of the act. The scheduled tasks reached their fruition late on the afternoon of November 25, 2023. Within less than an hour of the systems going dark, employees began receiving an urgent email from an external address.
The subject line of the email was stark and intimidating: “Your Network Has Been Penetrated.” The message detailed the extent of the sabotage, informing the company’s leadership that all administrators had been locked out or deleted and that the firm’s backups had been compromised. To force the company’s hand, the email threatened that 40 random servers would be permanently shut down each day for a ten-day period unless a ransom of 20 bitcoin was paid. At the time of the demand, 20 bitcoin was valued at approximately $750,000.
Despite the pressure applied by the attacker, the victim firm chose not to comply with the ransom demand. Instead, the company immediately initiated an aggressive internal forensic analysis to determine the root cause of the network anomalies. By correlating internal system logs with physical access records, the company’s IT security team began to construct a timeline that pointed toward an internal actor. The firm promptly engaged the Federal Bureau of Investigation, providing the authorities with the technical evidence necessary to launch a criminal investigation.
The FBI’s investigation moved quickly. By tracking the unauthorized activity and the origin of the malicious network commands, agents were able to trace the connection directly to a residential IP address in Warren County, New Jersey, where Rhyne had been residing at the time of the attack. This digital trail served as the foundation for the criminal complaint filed by FBI Special Agent Timothy Lee on August 8, 2024. Following the filing of the complaint, Rhyne was taken into custody on August 27, 2024, in Kansas City, where he had relocated following his departure from the firm.
Rhyne entered his guilty plea on April 1, 2026, appearing before Judge Shipp in the federal courthouse in Trenton. The sentencing hearing on September 28, 2026, solidified the legal consequences for his actions. The 32-month prison term reflects the gravity with which federal courts treat the abuse of administrative access and the intentional sabotage of critical corporate infrastructure.
The case serves as a stark reminder of the evolving landscape of cybercrime, where the greatest threat to an organization’s security is often already behind the firewall. Insider threats are particularly difficult to mitigate because they involve individuals who have been granted legitimate access to the very systems they eventually target. For industrial firms that provide services to essential sectors—such as those served by the victim in this case—the resilience of the network is not just a matter of corporate bottom lines, but a matter of public and industrial safety.
In recent years, the U.S. Department of Justice has been increasingly active in prosecuting individuals responsible for ransomware and cyber-extortion schemes. This case is one of several recent examples of federal authorities successfully identifying and sentencing those responsible for such attacks. Other notable cases have included the prosecution of former soldiers, international ransomware developers, and members of prolific hacking groups such as Scattered Spider. Each of these cases, including the one against Rhyne, underscores the commitment of law enforcement agencies to dismantling the infrastructure of cybercrime and holding perpetrators accountable, whether they act alone or as part of a larger criminal network.
The firm’s swift decision to alert the FBI and conduct a thorough internal forensic investigation proved instrumental in the successful outcome of this case. By refusing to pay the ransom, the company prevented the attacker from profiting from his scheme and allowed federal authorities to secure the digital evidence required to secure a conviction. The incident remains a prominent example of how organizations must prepare not only for external threats but also for the potential betrayal of those entrusted with the keys to their digital kingdoms. As the legal proceedings conclude, the case of Daniel Rhyne stands as a deterrent to other employees who might consider leveraging their technical expertise for criminal extortion.
