Engineer Who Sabotaged Employer for Bitcoin Ransom Gets Prison Time

Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced Sept. 28 in federal court in Trenton after previously pleading guilty to extortion involving a threat to damage a protected computer and intentionally damaging a protected computer, according to the U.S. Attorney’s Office for the District of New Jersey.

Rhyne worked as a core infrastructure engineer for the unidentified industrial company, giving him administrative privileges over its computer systems. An FBI criminal complaint filed in 2024 describes a methodical effort to exploit that access. Investigators said Rhyne created a hidden virtual machine on the company network—protected by the password “TheFr0zenCrew!”—and used it to remotely access an administrator account.

On Nov. 25, 2023, prosecutors said, Rhyne scheduled a series of automated tasks designed to execute later that day. The commands would delete 13 domain administrator accounts, change the passwords of 301 user accounts, alter local administrator passwords affecting 254 servers, and change credentials tied to more than 3,200 employee workstations.

Other scheduled tasks would shut down company servers and computers. Investigators said the combined actions were designed to deny the company access to its own systems and data.

Evidence Pointed to an Internal Threat

The complaint detailed signs of preparation. Days before the attack, searches conducted from the hidden virtual machine included queries such as how to change administrator passwords from a command line, delete a domain account, and remotely shut down a computer. Similar searches were found on Rhyne’s company laptop, investigators said.

At about 4 p.m. on Nov. 25, network administrators discovered that their accounts had been deleted. Roughly 44 minutes later, employees received an extortion email claiming that all IT administrator accounts had been deleted and backups erased. The sender threatened to shut down an additional 40 servers each day for 10 days unless the company paid approximately 20 bitcoin by Dec. 2—then worth about $750,000, and currently valued near $1.67 million.

Investigators ultimately linked the hidden virtual machine to Rhyne’s account and company laptop. They also found that the password protecting the extortion email address was “TheFr0zenCrew!”—the same password used for the hidden virtual machine.