Overview
- Federal court filings say Daniel Rhyne used his administrator access in November 2023 to create a hidden virtual machine and schedule tasks that deleted 13 domain admin accounts and reset hundreds of passwords.
- Prosecutors say Rhyne sent an extortion email demanding 20 bitcoin and threatening to shut down 40 servers a day unless paid, and scheduled tasks later blocked access to 254 servers and about 3,284 workstations.
- Investigators linked the sabotage to the hidden VM because its password matched resets on accounts and the extortion email, and they traced activity patterns and network logs back to Rhyne’s company laptop.
- Rhyne pleaded guilty in April 2026 to extortion and intentional damage to a protected computer and was sentenced by Judge Michael A. Shipp on September 28, 2026 to 32 months in federal prison.
- The case highlights the persistent risk from privileged insiders, the continued use of cryptocurrency for ransom demands, and the importance of controls on admin accounts and VM provisioning in corporate networks.