Daniel Rhyne changed passwords and deleted administrator accounts using the company's own tools, then emailed coworkers a ransom demand.

 

What happened

Daniel Rhyne, a 57-year-old former core infrastructure engineer from Kansas City, Missouri, was sentenced to 32 months in prison for locking thousands of devices on the network of the New Jersey industrial company that employed him, BleepingComputer reported on October 6, 2026. He was arrested in August 2024 and later pleaded guilty. Between November 8 and November 25, 2023, he reached the company's network remotely without authorization using an administrator account, according to court documents. The changes he made blocked access to 254 servers and a further 3,284 workstations.

 

Going deeper

No malware was involved at any point. Rhyne set up scheduled tasks, which are instructions telling a computer to run something automatically at a chosen time, on the server that manages network logins for the entire organization. Those tasks changed the administrator password, deleted 13 administrator accounts, and reset the passwords on 301 staff accounts. Two further tasks changed passwords on local administrator accounts, which is what locked the servers and workstations. He also arranged for servers and workstations to shut down at random across several days in December 2023. Every one of those actions is a routine administrative function, performed with the credentials of someone authorized to perform it.

 

What was said

Network administrators "began receiving password reset notifications for a Victim-1 domain administrator account, as well as hundreds of Victim-1 user accounts" at around 4:00 p.m. on November 25, 2023, the criminal complaint states, quoted by BleepingComputer. Shortly afterwards, they found every other administrator account deleted. Rhyne emailed coworkers that day under the subject line "Your Network Has Been Penetrated," claiming server backups had been deleted and threatening to shut down 40 random servers a day for ten days unless the company paid 20 bitcoin, worth roughly $750,000 at the time.

 

In the know

Investigators found the planning in his search history. On November 22, while preparing the scheme, Rhyne used an account on a hidden virtual machine, meaning a separate computer running in software on his own, to search for how to change passwords across an organization, delete administrator accounts, and clear Windows activity logs. A week before that, he had run similar searches on his laptop, including how to change a local administrator password from the command line and how to shut down a computer remotely. A second insider case reached sentencing earlier this year, when Cameron Curry, a 27-year-old data analyst contractor in North Carolina, received two years for extorting the software company he worked for.

 

The big picture

Cases of this kind are rarer than external attacks and harder to see coming. Internal actors account for 19% of healthcare breaches, with privilege misuse appearing as its own pattern at 3%, according to Verizon's 2026 healthcare snapshot, drawn from 1,438 confirmed data disclosures in the sector. That share rarely moves and attracts little attention next to external attackers, who account for the other 81%. What this case adds is how little an insider needs beyond the access they already hold, since every action Rhyne took was a routine administrative function performed with authorized credentials. Separating duties so no single account can both make changes and remove the record of them is the control that addresses it, alongside forwarding logs to a system administrators cannot alter and requiring a second approver for actions affecting many accounts at once. None of those depend on detecting malicious intent in advance.

 

FAQs

Why is an insider attack harder to detect than malware?

Security tools identify code and behaviour that should not be present. An administrator changing passwords and creating scheduled tasks is performing their job, so the activity matches what the system expects from that account.

 

What does reviewing system activity actually involve?

Examining audit logs, access reports, and security incident tracking records at a defined interval, looking for activity inconsistent with normal operations. The rule requires the review rather than only the collection, and organizations frequently log without anyone looking.

 

How do organizations protect logs from someone with administrator access?

By forwarding them in real time to a separate system the administrator cannot reach or alter. Logs held only on the machine that generated them can be cleared by anyone with enough privileges.

 

What limits the damage a single administrator account can do?

Separating duties so that no one account can both make changes and remove the record of them, requiring a second approver for actions affecting many accounts, and issuing administrative access for a defined period rather than permanently.

 

Does HIPAA require anything specific about departing staff?

The Security Rule requires procedures for terminating access when employment ends or when a workforce member's role changes. Organizations should be able to show how quickly access is removed and who verifies it.