Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

Daniel Rhyne exploited his privileged access as a core infrastructure engineer to delete admin accounts and reset hundreds of passwords, holding his employer hostage for $750,000 in bitcoin. The root cause was insufficient controls around privileged account usage, including a lack of real-time alerting on mass account modifications and inadequate offboarding or access review processes. This case highlights how insider threats can be just as devastating as external attacks — and often harder to detect when trusted employees misuse legitimate credentials. The fact that the FBI was able to trace the attack to Rhyne's IP address underscores the critical value of robust logging, but the damage had already been done by the time forensics were applied.