A former core infrastructure engineer at an industrial company has been sentenced to 32 months in prison for a sabotage and extortion scheme targeting his employer. The case, reported by SecurityWeek from a US Department of Justice announcement, involved scheduled tasks on a domain controller that deleted administrator accounts and reset passwords across users, servers and workstations.
The disruption was followed by a ransom demand for 20 bitcoin. The victim did not reportedly pay. Instead, internal forensic work correlated network anomalies with physical-access records, and the FBI traced unauthorized activity to the former employee’s residential IP address.
The case is a reminder that privileged access needs continuous controls: separate administrative duties, audit scheduled tasks and directory changes, maintain resilient backups, alert on bulk credential resets and preserve logs that can support rapid investigation. Insider-risk controls are most effective when they pair technical detection with disciplined offboarding and access review.