A former core infrastructure engineer was sentenced to 32 months in federal prison for breaking into his employer’s network, changing the passwords of thousands of accounts, shutting down servers, and demanding roughly $750,000 in bitcoin to stop further damage. The case shows how a single trusted administrator account, used against the company that issued it, can take thousands of devices offline in a matter of days.<\/p>\n
Court documents describe an attack carried out between November 8 and November 25, 2023, using an administrator account that was not authorized for the activity. The engineer scheduled tasks on the domain controller that changed the password of the administrator account to a string naming a hacker crew, deleted 13 domain admin accounts, and reset the passwords for 301 domain user accounts to the same string. Two more local admin accounts were reset to a separate string, which blocked access to 254 servers. Two further admin accounts were reset, blocking access to 3,284 workstations. Over several days in December 2023, random servers and workstations on the network were shut down.<\/p>\n
On November 25, the engineer sent coworkers a ransom email titled “Your Network Has Been Penetrated.” The message claimed that server backups had been deleted so that data recovery was impossible and threatened to shut down 40 random servers a day for the next 10 days unless the company paid a 20 bitcoin ransom. At the time, 20 bitcoin was worth roughly $750,000.<\/p>\n
Network administrators at the company, identified in the criminal complaint as Victim-1 and headquartered in New Jersey, began receiving password reset notifications for a domain administrator account and hundreds of user accounts at approximately 4:00 p.m. EST on November 25. They soon discovered that every other domain administrator account had been deleted, cutting off administrative access to the computer networks.<\/p>\n
Investigators later found that on November 22, while the scheme was being prepared, the engineer used an account on a hidden virtual machine to search the web for instructions on changing domain user passwords, deleting domain accounts, and clearing Windows logs. A week earlier, searches on a personal laptop included “command line to change local administrator password,” “command line to remotely change local administrator password,” and “how to remotely shutdown a computer using cmd.”<\/p>\n
The engineer, 57, from Kansas City, Missouri, was arrested in August 2024 and released after an initial appearance in federal court. He pleaded guilty for his role in what the court described as a failed extortion plot targeting the New Jersey company that employed him. On October 6, 2026, he was sentenced to 32 months in prison.<\/p>\n
The incident is a textbook example of a trusted insider turning the tools of system administration against the employer. Every step the engineer took, from changing the domain admin password and deleting the remaining admin accounts to resetting thousands of local user accounts and shutting down random servers, used built-in Windows and Active Directory capabilities. No malware had to be smuggled in for the core of the attack to work. The damage was contained only because the ransom demand surfaced the scheme to administrators who could begin manual recovery.<\/p>\n
Two details stand out for defenders. First, the planning was visible in plain web search history and a hidden virtual machine on the company network, both of which were recovered after the fact. Second, the pivot from “I control these accounts” to “I control every device that authenticates against them” happened in a single batch of scheduled tasks on the domain controller, which is the single most sensitive server in most Windows environments.<\/p>\n
Earlier in 2026, in March, a 27-year-old data analyst contractor from North Carolina was sentenced to two years in prison after being found guilty of extorting his employer, Brightly Software, a Software-as-a-Service company previously known as SchoolDude, for $2.5 million. Taken together, the two cases point to a pattern in which current and former staff, not external criminal crews, were the source of the most consequential ransomware-style demands against their own employers in the past year.<\/p>\n
A 57-year-old former core infrastructure engineer from Kansas City, Missouri, was sentenced to 32 months in federal prison on October 6, 2026, after pleading guilty to his role in a failed extortion plot against the New Jersey industrial company that employed him.<\/p>\n
He used an administrator account to schedule tasks on the domain controller that reset the domain admin password, deleted 13 other domain admin accounts, reset passwords for 301 domain user accounts, reset local admin passwords to block access to 254 servers, and reset two more admin accounts that blocked access to 3,284 workstations.<\/p>\n
The ransom email, titled “Your Network Has Been Penetrated,” demanded 20 bitcoin, worth roughly $750,000 at the time, and threatened to shut down 40 random servers a day for 10 days if the company did not pay.<\/p>\n