Loading story…
An Ohio IT contractor, Maxwell Schultz, pleaded guilty to sabotaging his former employer's network after being fired, causing over $862,000 in damages. Schultz gained unauthorized access by impersonating another contractor, reset approximately 2,500 passwords using a PowerShell script, and attempted to cover his tracks by deleting system logs. The attack resulted in widespread employee downtime and disrupted customer service, with Schultz facing up to ten years in prison and a $250,000 fine upon sentencing.
In a separate case, a technical manager at Dutch wind farm operator Nordex was sentenced to 120 hours of community service for secretly installing cryptocurrency mining rigs and Helium network nodes at two wind farm sites. The mining operation, discovered shortly after the company suffered a ransomware attack, exploited company resources and posed operational risks to the turbines. The employee was also ordered to pay restitution for the unauthorized use of company infrastructure. Both incidents highlight the ongoing threat posed by malicious insiders abusing privileged access for personal gain or retaliation.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
A court sentenced the wind farm worker for secretly converting turbine-related systems into a cryptocurrency mining operation. The sentencing marked the public legal resolution of the case.
The ex-contractor pleaded guilty or otherwise admitted sabotaging the former employer's environment, confirming responsibility for the attack and the reported financial damage. This development was reported by multiple outlets and represents the key legal milestone in the case.
A fired technology worker carried out sabotage against a former employer, causing about $862,000 in damage. The incident was later described in multiple reports as a criminal case involving an admission of guilt.
A worker at a wind farm turned wind turbines into a covert cryptocurrency mining operation, misusing employer-owned systems and infrastructure. The activity became the basis for a later criminal case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcego.theregister.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former Saydel Community School District IT employee **Ezekiel Dean Potter** was sentenced to **21 months in prison** after prosecutors said he carried out a prolonged cyber sabotage campaign against the Iowa district following his April 2023 termination. Authorities said Potter kept access to more than 300 district credentials and, from May 2023 through January 2025, used them to delete accounts, take down the district’s Facebook page, interfere with **Apple School Manager**, target **GoDaddy**, and compromise **Google/Gmail**, **PowerSchool Schoology**, and other school services. The intrusions locked teachers out of platforms, disrupted classrooms, and caused tens of thousands of dollars in losses, with reported direct costs exceeding **$73,000** and restitution set at **$59,668.81**. Investigators tied the activity to Potter through forensic evidence including IP addresses linked to later employers, activity traced despite VPN use, and a USB drive containing spreadsheets of district usernames and passwords. Potter pleaded guilty in January 2026 to computer fraud charges under the **Computer Fraud and Abuse Act** and was also ordered to serve supervised release with computer-use monitoring conditions.
Jun 29, 2026
Recent court actions highlighted multiple **cyber-enabled crimes** resulting in prison sentences and follow-on legal measures. In the US, federal authorities announced sentencing and impending deportation of two Venezuelan nationals tied to a multi-state **ATM jackpotting** scheme that used **Ploutus** malware to force cash-out from legacy ATMs, with theft totaling hundreds of thousands of dollars and investigations linking activity to a broader network associated with **Tren de Aragua**. Separately in France, a Romanian national was sentenced in Paris to a five-year term with one year suspended (effectively four years to serve) for involvement in **ransomware** attacks using the **“Umbrella”** ransomware, with reported damages nearing €1 million and related cases spanning multiple European countries. In a separate, unrelated case, **Ilya Lichtenstein**—convicted for stealing **120,000 bitcoins**—publicly sought a “second chance” and a cybersecurity job after serving a 60-month sentence and being moved to home confinement, citing efforts to rehabilitate and cooperate. Collectively, the reporting underscores ongoing law-enforcement focus on financially motivated cybercrime ranging from malware-assisted physical compromise of financial infrastructure to enterprise-targeting ransomware, alongside continued public attention on high-profile cryptocurrency theft prosecutions.
Jun 29, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026