Engineer Extortion Sentence: 32 Months for Locking Thousands of Devices

A former infrastructure engineer has received a 32-month prison sentence after locking administrators out of thousands of devices on his employer’s network. The engineer extortion sentence follows a failed attempt to demand 20 bitcoin, worth approximately $750,000 at the time.

Daniel Rhyne, 57, of Kansas City, Missouri, pleaded guilty over the attack against an industrial company headquartered in New Jersey. He used administrative access to disrupt accounts and interfere with the company’s servers and workstations.

Authorities arrested Rhyne in August 2024. The attack took place in late 2023.

Account Changes Blocked Access Across the Network

According to court documents, Rhyne accessed the company’s network without authorization using an administrator account between November 8 and November 25, 2023.

He then scheduled tasks on a domain controller to change an administrator password, delete 13 domain administrator accounts and reset passwords for 301 domain users.

Additional tasks changed local administrator passwords, blocking administrative access to 254 servers and 3,284 workstations.

As a result, the company’s network administrators lost access needed to manage large parts of the environment. The attack relied on account manipulation and scheduled disruption rather than the file encryption commonly associated with ransomware.

Rhyne also arranged for random servers and workstations to shut down over several days in December 2023.

Ransom Email Demanded 20 Bitcoin

On November 25, Rhyne sent colleagues an email claiming that someone had penetrated the company’s network.

The message demanded 20 bitcoin and threatened to shut down 40 randomly selected servers each day for ten days unless the company paid.

It also claimed that server backups had been deleted to prevent recovery. However, the account provided does not independently establish that Rhyne destroyed those backups.

That afternoon, administrators began receiving password-reset notifications for a domain administrator account and hundreds of user accounts.

Shortly afterward, they discovered that the other domain administrator accounts had disappeared. Consequently, they could no longer access the network through those accounts.

Investigators Traced Searches Used to Prepare the Attack

Investigators found evidence that Rhyne researched the actions involved in the extortion scheme before sending the demand.

On November 22, he used his account on a hidden virtual machine to search for information about changing domain passwords, deleting accounts and clearing Windows logs.

Meanwhile, searches on his laptop from the previous week concerned remote administrator-password changes and computer shutdowns.

Those findings helped investigators connect Rhyne to preparations for the network disruption.

The engineer extortion sentence follows his guilty plea over the scheme, which targeted the same company that employed him to support its infrastructure.

Separate Case Also Involved Employee Cyber Extortion

The sentencing follows another recent prosecution involving an employee’s attempt to extort a business.

In March 2026, a court sentenced North Carolina data analyst contractor Cameron Curry to two years in prison. His case involved a $2.5 million extortion demand against Brightly Software.

Although the cases were separate, both involved workers targeting their employers through access associated with their roles. Rhyne’s attack specifically demonstrated how administrative account changes could cause widespread disruption without encrypting company files.