Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

In November 2023, Daniel Rhyne, a former core infrastructure engineer at an industrial firm headquartered in New Jersey, executed a cyber extortion attack against his employer. He scheduled tasks on the firm's domain controller to delete 13 domain administrator accounts, reset passwords for 301 domain user accounts, and change passwords for local administrator accounts affecting thousands of servers and workstations. This action denied the company access to its systems and data. Rhyne demanded 20 bitcoin (approximately $750,000 at the time) to avoid further damage, including shutting down 40 servers daily over ten days. The company did not pay the ransom and initiated an internal forensic investigation, which, with FBI involvement, traced the attack to Rhyne's residential IP. He was arrested, pleaded guilty to extortion and intentional damage to a protected computer, and sentenced to 32 months in federal prison.

The attack caused denial of access to critical systems and data by deleting administrator accounts and resetting passwords across thousands of servers and workstations. This disruption could have severely impacted the firm's operations across multiple industrial sectors. However, the company did not pay the ransom and was able to conduct a forensic investigation to identify the perpetrator. No evidence suggests that the ransom demand was met or that further damage occurred beyond the initial sabotage.

The victim firm promptly detected the attack, did not pay the ransom, and conducted an internal forensic investigation correlating network logs with physical access records. Law enforcement involvement led to the identification and prosecution of the insider. Organizations should monitor for unusual administrative activities, enforce strict access controls, and have incident response plans to quickly address insider threats. Since this is a criminal act by an insider, remediation involves both technical controls and personnel security measures.