A former core infrastructure engineer was sentenced to 32 months in prison for locking thousands of devices on his employer's network and demanding 20 bitcoin. The sentence was reported on 6 October 2026. The attack itself ran in November and December 2023 against an industrial company based in New Jersey.
What happened
Daniel Rhyne, 57, of Kansas City, Missouri, pleaded guilty after an August 2024 arrest. Court records say he used an administrator account between 8 and 25 November 2023, then planted scheduled tasks on the domain controller.
Those tasks reset the domain administrator password, deleted 13 domain admin accounts, and reset 301 domain user passwords. Further tasks reset local admin passwords on 254 servers and on 3,284 workstations. He also shut systems down over several days in December. On 25 November he emailed coworkers a note titled "Your Network Has Been Penetrated" and demanded 20 bitcoin, about $750,000 then, claiming backups were gone.
Who is affected
This is one employer, not a campaign. The pattern is the part that travels. A single standing domain admin account, plus the right to create scheduled tasks, was enough to lock an industrial Windows estate.
- 254 servers blocked via local admin password changes
- 3,284 workstations locked the same way
- 13 domain admin accounts deleted
- 301 domain user passwords reset
What to do now
Remove standing domain admin rights from daily accounts, alert on mass password resets and new scheduled tasks on domain controllers, and disable access the day someone in infrastructure leaves. Offboarding that waits for payroll is how this class of incident starts. Backups that the same admin can delete are not backups.
Source: BleepingComputer, 6 October 2026.
Also on the blog
- NetScaler CVE-2026-88779 (CVSS 8.7) crashes SAML appliances
- FortiMail CVE-2026-104286 (CVSS 9.8) file-write zero-day
- Exchange CVE-2026-96940: signed-in users can read other mailboxes
- Atlassian CVE-2026-21589 (CVSS 9.3) file read on 8 products
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.