Engineer Gets 32 Months for Bitcoin Extortion Plot Against His Own Employer

What it is

FBI/DOJ case detail on Daniel Rhyne, 59, former core infrastructure engineer (virtual machine hosting subject matter expert) at an unnamed Somerset County, NJ industrial company. Sentenced September 28, 2026 by U.S. District Judge Michael A. Shipp (Trenton) to 32 months after pleading guilty in April to extortion and intentional damage to a protected computer.

How it works

Rhyne created an unauthorized virtual machine on the company network on November 9, 2023 — more than two weeks before the attack. On November 25, 2023 at ~4pm, a remote desktop session from that hidden VM triggered scheduled tasks that: reset passwords on hundreds of accounts to "TheFr0zenCrew!" (including 301 user accounts and the admin account), deleted 13 domain administrator accounts, changed passwords affecting 254 servers and 3,284 workstations, and scheduled servers to shut down 40/day starting December 3. Forty-four minutes after the account lockouts began, an extortion email ("Your Network Has Been Penetrated") went out demanding €700,000 (~20 BTC, ~$750K) by December 2.

Preconditions / Affected

Required insider access and privilege: Rhyne's role as core infrastructure/VM hosting SME gave him the standing to stand up a VM on the corporate network undetected for over two weeks before use.

What to do

No remediation guidance given; this is a sentencing report, not an advisory. The investigative chain is the reusable part for defenders building detection/forensics playbooks:

• Correlate endpoint browsing activity gaps — the FBI noted Rhyne's laptop browsing stopped exactly when browsing occurred on the hidden VM, implying shared-hands use.
• Cross-reference physical building access logs against account login timestamps (Rhyne entered HQ minutes before his account logged in on the attack day).
• Tie remote network connections to known home/residential IPs around the time of suspicious sessions.
• Flag pre-attack search history as an indicator: the VM's user searched "how to clear all windows logs from command line" and "how to remotely shutdown a computer using cmd" days before acting.
• Treat an unauthorized/hidden VM with an unexplained creation date as a standalone red flag — this one existed 16 days before it was used.

Caveats

Prosecutors have not named the victim company. The complaint also charged wire fraud, but that count was not part of the two-count guilty plea (extortion + intentional damage), so it carries no sentencing weight here. Maximum exposure was 5 years (extortion) + 10 years (damage); actual sentence was 32 months.