Fired Developer Deploys Malware Kill Switch—Gets Four Years in Prison and Zero Chill Points

Some people rage-quit. Some people write passive-aggressive exit emails. And then there’s Davis Lu—a former senior software developer who decided the best way to handle a demotion and eventual termination was to deploy a malware kill switch that locked out his entire company.

Lu didn’t just burn bridges. He coded a self-destruct button and tied it to his own login credentials. When Eaton Corporation finally put him on leave in 2019, the kill switch activated automatically. The result? System crashes, blocked logins, deleted files, and hundreds of thousands of dollars in damage.

The Kill Switch Was Literally Named After the Developer

Lu’s malicious code wasn’t subtle. He named the kill switch “IsDLEnabledinAD”—short for “Is Davis Lu enabled in Active Directory.” That’s not just sabotage. That’s branding.

According to the Department of Justice, Lu had been quietly sabotaging Eaton’s systems since his demotion in 2018. He tested the kill switch on the company’s QA servers, refined it over months, and set it to trigger the moment his access was revoked. Spoiler: it worked.

Revenge Coding Is Not a Career Strategy

Lu didn’t plead guilty. He admitted to the sabotage back in 2019 but still tried to make it look like his coworkers were behind it (dude was cold for that one). He deleted encrypted data from his company laptop before handing it over, hoping to cover his tracks.

But the FBI traced the damage right back to him. And now? He’s serving four years in prison, followed by three years of supervised release. That’s a long time to reflect on whether revenge scripts are worth it. Hope he’s not allowed computer access at any point during this time.

The Takeaway: Don’t Be This Guy

This isn’t just a wild tech story—it’s a flashing neon warning sign for both employees and employers. If you’re mad at your boss, maybe go scream into a pillow or write a spicy blog post. Don’t deploy malware.

And if you’re an employer? Revoke access immediately. Because the next disgruntled coder might not just walk out—they might take your servers with them.