Timeline: How One Insider Locked Thousands of Company Devices, and the 32-Month Sentence That Followed
A former infrastructure engineer at a New Jersey industrial company has been sentenced to 32 months for an extortion plot that locked out 254 servers and 3,284 workstations. Here is how it unfolded.
Most ransomware stories start with a stranger. This one started with an employee who already had the keys. A former core infrastructure engineer at an industrial company headquartered in New Jersey has been sentenced to 32 months in prison after a failed attempt to extort his employer. Court records show how the plot came together.
The timeline
- November 8–25, 2023: Daniel Rhyne, of Kansas City, Missouri, used an administrator account to reach the company’s network remotely without authorization, and set up scheduled tasks on the domain controller.
- About a week before November 22: Searches on his laptop included how to change a local administrator password from the command line, how to do it remotely, and how to shut down a computer remotely.
- November 22, 2023: From an account on a hidden virtual machine, he looked up how to change domain user passwords, delete domain accounts and clear Windows logs.
- November 25, 2023, around 4:00 p.m. EST: The tasks fired. Network administrators began receiving password-reset notices for a domain admin account and hundreds of user accounts, then found every other domain administrator account deleted. In all, 13 domain admin accounts were removed and 301 domain user passwords changed. Local administrator password changes cut off access to 254 servers and 3,284 workstations.
- The same day: Coworkers received an email titled “Your Network Has Been Penetrated.” It claimed server backups had been deleted and threatened to shut down 40 random servers a day for ten days unless the company paid 20 bitcoin, about $750,000 at the time.
- December 2023: Random servers and workstations were shut down over several days.
- August 2024: Rhyne was arrested, and released after his first appearance in federal court.
- 2026: He pleaded guilty, and this week’s reporting confirms a 32-month prison sentence.
Not an isolated case
In March, a 27-year-old data analyst contractor in North Carolina, Cameron Curry, was sentenced to two years in prison for trying to extort $2.5 million from his employer, Brightly Software, a SaaS company formerly known as SchoolDude.
The details above come from Sergiu Gatlan’s report for BleepingComputer, which quotes the criminal complaint.
What this means for your company
- Split the keys. No single person should be able to delete every domain administrator account. Keep at least one emergency admin account under separate, documented control.
- Alert on mass changes. Hundreds of password resets or admin deletions in minutes should page someone right away, whoever triggers them.
- Protect backups from insiders too. Keep at least one copy that day-to-day admins can’t delete, and test restoring from it.
- Watch remote sessions and scheduled tasks. Unexpected remote desktop logins and new tasks on domain controllers are early warning signs worth reviewing.
- Make offboarding and access reviews routine. Check privileged access regularly, not just when someone leaves.
Need help putting insider-proof controls around your admin accounts and backups? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
