FBI Arrests Ransomware Negotiation Firm Executive in ShinyHunters Probe

FBI Arrests Ransomware Negotiation Firm Executive in ShinyHunters Probe The FBI has arrested Edward Dubrovsky, an executive at a Canadian cybersecurity firm specializing in ransomware negotiations, on cyber extortion and conspiracy charges connected to an ongoing investigation into the ShinyHunters hacking group. Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania on extortion and conspiracy charges. Dubrovsky, connected to Canadian security firms Cypfer and CyberSteward, was visiting Philadelphia for a cyber insurance summit. The arrest ties into a centralized FBI probe into ShinyHunters, a hacking syndicate that extorted over $70 million this year and compromised FBI personnel records. Investigators are examining devices from previously arrested group members, and further charges against ransomware negotiation executives may follow. Arrest and Legal Charges Federal agents arrested 54-year-old Edward Dubrovsky in Pennsylvania on October 8 on charges of conspiracy to threaten to impair the confidentiality of information with intent to extort money and interference with commerce by threats. Held at a federal detention facility in Philadelphia, Dubrovsky had his case transferred to the Eastern District of Texas, which serves as the central hub for the FBI's investigation into the ShinyHunters cybercrime group. Dubrovsky's Industry Background Dubrovsky was visiting Pennsylvania for the Cyber Risk Summit, sponsored prominently by Canadian firm Cypfer. While Dubrovsky previously listed himself as a Cypfer co-founder, a company spokesperson stated he served as a managing director until resigning in December 2025. Dubrovsky, who subsequently joined the security firm CyberSteward, authored a book detailing strategic responses to cyber extortion and ransomware negotiations. The ShinyHunters Investigation The FBI reports ShinyHunters has extorted over $70 million this year, primarily by stealing data from corporate software-as-a-service accounts through phishing and stolen credentials. The group recently stole medical, psychiatric, and unit data regarding thousands of agents from an FBI recruitment portal. Dubrovsky's arrest follows the apprehension of convicted hacker Pepijn van der Stap in the Netherlands and cooperating teenage member Saif Al-din Khader, with authorities continuing to review seized digital devices.

涉嫌协助黑客组织ShinyHunters，勒索软件谈判公司高管遭FBI逮捕 美国联邦调查局（FBI）在宾夕法尼亚州逮捕了一名加拿大网络安全高管，指控其涉嫌协助黑客团伙ShinyHunters进行网络勒索与合谋犯罪。该团伙此前曾窃取数千名FBI特工的敏感数据并进行敲诈。 加拿大网络安全高管Edward Dubrovsky在赴美参加网络风险峰会期间被FBI逮捕，面临网络敲诈和合谋指控。 法院记录与联邦监狱数据显示，54岁的Dubrovsky被控合谋以威胁破坏信息保密性为由进行勒索，案件已移送至主导该调查的德克萨斯州东区法院。 FBI正围绕黑客组织ShinyHunters展开深入追查，该团伙今年已勒索超7000万美元，且已有关键黑客成员被捕并配合调查。 谈判公司高管赴美参会期间被捕 消息人士透露，被捕男子当时正前往宾夕法尼亚州参加网络保险行业会议，其所在公司专门为受害者处理针对网络犯罪团伙的勒索谈判。公开记录显示，曾任职于Cypfer、现关联CyberSteward的Edward Dubrovsky曾发帖确认赴费城参会。法院与监狱系统档案证实，54岁的Dubrovsky于10月8日因网络敲诈与合谋罪名被拘留，目前未委任辩护律师，其案件已被移交至负责统筹ShinyHunters调查的FBI德克萨斯州外勤部门。 嫌疑人背景与专长领域 Dubrovsky是勒索应对领域的从业者，曾撰写《网络敲诈战略应对》一书，主张与犯罪分子的沟通并非等同于谈判或承诺付款，而是一种争取时间、收集信息和评估局势的策略。其前雇主Cypfer澄清称，Dubrovsky曾任董事总经理并于2025年12月辞职，并非其领英页面所声称的联合创始人。 ShinyHunters调查持续扩大 据FBI统计，ShinyHunters主要利用钓鱼手段盗取SaaS账户数据并索要赎金，年内勒索金额已超过7000万美元，该团伙此前还窃取了包含特工医疗及任务信息的FBI招募系统数据。调查人员正在分析此前在荷兰被捕黑客的电子设备，另有一名接管该黑客组织的青少年成员也已被拘并配合FBI调查，消息指未来可能有更多勒索谈判公司的核心人员面临起诉。

Agents with the **Federal Bureau of Investigation** (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the **ShinyHunters** hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times [reported today](https://www.nytimes.com/2026/10/09/us/politics/fbi-hack-shinyhunters-arrest.html) that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did [a statement](https://x.com/FBIDirectorKash/status/2108566367011999780?s=46&t=jxLTOF6G9gZnhmWqh93ZrA) on Twitter/X about the arrest from **FBI Director Kash Patel**. One source close to the investigation told KrebsOnSecurity the Canadian person arrested this week was visiting Pennsylvania for a cyber insurance conference, and that the suspect’s company specialized in handling ransomware negotiations with cybercrime groups. Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas. An online search reveals the [Cyber Risk Summit](https://netdiligence.com/conferences/cyber-risk-summit-philadelphia-2026/speakers) was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its [biggest sponsor](https://netdiligence.com/conferences/cyber-risk-summit-philadelphia-2026/sponsors) was a Canadian security company called **Cypfer**. According to LinkedIn, one of Cypfer’s “ex-founders” was **Edward Dubrovsky**, who is now associated with another Canadian security firm and sponsor called **CyberSteward**. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team. \[**Update: Oct. 10, 9:58 a.m. ET:** A spokesperson for Cypfer said Dubrovsky was not a founder or co-founder as his LinkedIn profile claims, but instead served as a managing director before resigning in December 2025\]. “Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic,” Dubrovsky wrote. Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges. Several of those documents — including the core complaint — are now sealed. But a handful of them were [indexed at Courtlistener.com](https://www.courtlistener.com/docket/74942095/united-states-v-dobrovsky/), including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.” The inmate locator at the **U.S. Bureau of Prisons** website reports that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia. But [the court records](https://www.courtlistener.com/docket/74942095/united-states-v-dobrovsky/) indexed by CourtListener include a notice filed on October 9 that moved the case to the Eastern District of Texas, which sources say is now the epicenter of the FBI’s ShinyHunters investigation. The FBI declined to comment for this story. Dubrovsky’s [LinkedIn profile](https://www.linkedin.com/in/edubrovs/) states he is the author of *Cyber Extortion Strategic Response*, a 252-page book that promises to “take readers beyond the ransom note and into the decisions that determine how an organization responds, recovers, and protects what matters.” “At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay,” reads an excerpt from the book’s listing on Amazon. “Engagement can serve other objectives, including testing claims, gathering information, creating time, and preserving options while the organization evaluates its next move.” Mr. Dubrovsky could not be immediately reached for comment. KrebsOnSecurity also sought comment from other executives at CyberSteward, and will update this post in the event they respond. The available court records in Dubrovsky’s case show that he does not currently have an attorney and has yet to be appointed a public defender by the courts. ShinyHunters typically uses phishing and stolen credentials to siphon data from corporate accounts at software-as-a-service companies, and then threatens to publish the stolen data online unless a ransom demand is paid. According to the FBI, the group has extorted more than $70 million from victims so far this year. Sources tell KrebsOnSecurity the FBI has been poring over devices that were seized last month when the Dutch police [arrested the convicted cybercriminal Pepijn van der Stap](https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/) in connection with the ShinyHunters investigation, and that charges against principals at other companies that specialize in ransomware negotiation may be forthcoming. Immediately after Van der Stap’s arrest, another member of ShinyHunters named “**Rey**” assumed control over the group and began taunting the FBI over data the group stole from the agency’s online recruitment portal, which included each’s person’s unit and specialization, as well as medical and psychiatric records. Last week, Reuters reported that Rey — identified as a teenager named **Saif Al-din Khader** — had been detained and was cooperating with FBI investigators. On October 7, we [detailed](https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/) how Rey was apprehended as the cybercrime group allegedly sought to extort a navigation and digital aviation unit that was divested by Boeing in late 2025. *This is likely to be a fast-moving story. Updates will be noted along with timestamps.*