Employee arrested for locking Windows admins out of 254 servers in extortion plot

An alleged insider extortion incident: a former core infrastructure engineer remotely accessed a New Jersey industrial company's systems, changed passwords for domain and local administrator accounts and hundreds of user accounts, scheduled shutdowns that affected 254 servers and thousands of workstations, and sent a ransom demand for €700,000 (20 BTC). Forensic analysis tied web searches and use of a hidden VM to the activity; the suspect was arrested and faces charges including extortion, intentional computer damage, and wire fraud.