Ransomware Negotiator Arrest Reportedly Tied to ShinyHunters

When ShinyHunters steals a company's data, the next thing that arrives is an email: here is what we took, here is the bitcoin address, you have 72 hours. Many victims then call a specialist firm to handle the conversation. This week the FBI arrested a man whose career was built on those conversations.

Federal court records show an Edward Dobrovsky (the court's spelling) arrested in Pennsylvania on cyber extortion and conspiracy charges. KrebsOnSecurity identified him as Edward Dubrovsky, a figure linked to the Canadian firms Cypfer and CyberSteward, and reported that multiple sources tie the arrest to the ShinyHunters investigation.

Key Takeaways

• Edward Dubrovsky, a 54 year old Canadian, was arrested in Pennsylvania on October 8, 2026, and the case was committed to the Eastern District of Texas on October 9.
• The docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort money (18 U.S.C. 371 and 1030(a)(7)(B)) and Hobbs Act extortion and conspiracy (18 U.S.C. 1951), while the complaint itself is sealed.
• FBI Director Kash Patel announced the arrest of an unnamed "suspected co-conspirator" of ShinyHunters, and the link to Dubrovsky comes from reporters' sources, not from the FBI.
• Cypfer says Dubrovsky was a managing director who resigned in November 2025, not a founder, contradicting his LinkedIn profile and some press reports.
• ShinyHunters extorts victims through emails and calls that list stolen data and demand bitcoin within 72 hours, which is why who handles that reply channel now matters.

Who Is Edward Dubrovsky?

Edward Dubrovsky is a Canadian cyber extortion advisor whose public profile ties him to two firms that negotiate with criminals on behalf of victims. According to Krebs, his LinkedIn profile lists him as one of Cypfer's "ex-founders" and associates him with CyberSteward. BleepingComputer wrote that he "previously co-founded" Cypfer, and cited Politico reporting that CyberSteward is a trade name used by Cypfer.

Cypfer disputes the title. In an update added October 10, Krebs reported a Cypfer spokesperson saying Dubrovsky "was not a founder or co-founder as his LinkedIn profile claims, but instead served as a managing director before resigning in November 2025." Both versions are on the record, and the court filings do not settle it.

Krebs describes Cyber Extortion Strategic Response as a 252 page book, and quotes its Amazon listing: "communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay." About a month before his arrest, he posted that he planned to attend the Cyber Risk Summit with the CyberSteward team. Krebs places that summit at the Loews Philadelphia Hotel from October 5 to October 7, with Cypfer as its biggest sponsor.

What Is He Charged With?

He faces two federal counts tied to extortion. The CourtListener docket for case 2:26-mj-01973 in the Eastern District of Pennsylvania lists the complaint as:

• 18 U.S.C. 371 and 1030(a)(7)(B): conspiracy to threaten to impair the confidentiality of information with the intent to extort money. In plain terms, threatening to leak stolen data unless paid.
• 18 U.S.C. 1951(a) and (b)(2): interference with commerce by threats, described as Hobbs Act extortion and conspiracy to commit Hobbs Act extortion.

The docket shows a Rule 40 arrest on October 8, an initial appearance before Magistrate Judge Scott W. Reid, and a commitment order on October 9 sending him to the Eastern District of Texas. Krebs's sources describe that district as the center of the FBI's ShinyHunters investigation. One discrepancy worth correcting: Krebs reported that Dubrovsky had no lawyer, but the bail order signed October 8 appoints the Federal Defenders. The same order says he stipulated to identity and probable cause and will have his detention hearing in Texas. That is a step in moving the case, not a plea.

The complaint narrative is sealed. Nobody outside the case knows yet what conduct the government alleges.

Is the Arrest Connected to ShinyHunters?

Reporting says yes; the FBI has not said so. On October 9, Patel posted that "Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group," without naming the suspect or the place, as BleepingComputer reported. The New York Times reported the suspect was a Canadian citizen arrested in Pennsylvania. CBS News quoted a law enforcement source saying he "is believed to be directly involved in the hack of the FBI's website," and the RCMP said it "is aware of the arrest of a Canadian in the US in connection with the ShinyHunters hack."

The name comes from elsewhere. Krebs matched the Pennsylvania docket and a Bureau of Prisons listing for a 54 year old Edward Dubrovsky held in Philadelphia, and multiple sources told Krebs the arrest belongs to the ShinyHunters case. BleepingComputer says plainly that the FBI "has not publicly confirmed" Dubrovsky is the person Patel described, and that it is unclear whether his case connects to the FBI jobs portal breach. The FBI declined to comment to Krebs.

How Does This Fit the FBI's Crackdown?

It is at least the third publicly reported arrest or detention in about three weeks. The pressure began after ShinyHunters claimed the breach of the FBI jobs portal through a PeopleSoft flaw in September.

• September 15, Amsterdam: Dutch police arrested a 24 year old man identified as Pepijn van der Stap, once known as Umbreon. ShinyHunters denied any link.
• Early October, Jordan: Reuters reported that a member known as Rey was detained in Jordan and is aiding the FBI, identifying him as Saif al-Din Khader.
• October 8, Pennsylvania: the Dubrovsky arrest.

The FBI's own scale estimate came from Cyber Division Assistant Director Brett Leatherman, who said the group and its associates "have breached more than 140 organizations and collected at least $70 million in extortion payments since last year," per Nextgov. By our arithmetic, spread evenly, that is about $500,000 per breached organization, though real payments are never spread evenly. Krebs's sources add that charges against principals at other ransomware negotiation companies "may be forthcoming."

Why Does a Negotiator Arrest Matter to Victims?

Because the negotiator sees everything the victim is trying to hide from the attacker. In April, a Florida negotiator named Angelo Martino pleaded guilty to feeding BlackCat his clients' secrets. The Justice Department said the information he passed "included the victims' insurance policy limits and internal negotiation positions."

Nothing public says Dubrovsky did anything similar; his complaint is sealed and he has not been convicted. The structural point stands regardless of how his case ends. Most coverage of ShinyHunters focuses on the initial break in, the vished helpdesk or the stolen token. The Martino case showed the weak point can also sit at the end of the attack, in the channel the victim uses to answer the ransom email.

There is a compliance layer too. Treasury's OFAC advisory on ransomware payments names "companies involved in digital forensics and incident response" among those that "may risk violating OFAC regulations" when facilitating payments, and says civil penalties apply on a strict liability basis. A company that hires a negotiator inherits that firm's judgment about who it is paying.

What Does a ShinyHunters Extortion Email Look Like?

It reads like an invoice for your own data. Google's Threat Intelligence Group, which tracks the extortion arm as UNC6240, says the extortion involves calls or emails to employees "demanding payment in bitcoin within 72 hours," sometimes months after the data was taken. Its January 2026 follow up describes the typical contents:

• A list of what was allegedly stolen, a payment amount and a destination BTC address.
• A 72 hour deadline and threatened consequences if it passes.
• A Tox ID for negotiation and data samples hosted on Limewire.
• Contact addresses previously associated with the group, such as shinycorp@tutanota[.]com.

GTIG also saw escalation beyond email, including "harassment of victim personnel," and one case where the attackers used compromised mailboxes to send more phishing, then deleted the outbound emails to hide it. The way in is usually a phone call that ends on a fake SSO page, as in the Brinks Home vishing breach.

Why Email Users Should Care

Email is where both ends of a ShinyHunters attack land: phishing on the way in and the ransom demand on the way out. If attackers have been inside a corporate mailbox, the victim's own email may not be a safe place to plan a response. CISA's ransomware and data extortion guide warns that actors "may monitor your organization's activity or communications" and recommends "out-of-band communication methods such as phone calls."

Customers get the fallout. Once records leak, opportunists send their own "we have your data" emails to the people in them. We documented one such wave in July, where leaked ShinyHunters data fueled a $2,000 sextortion scam.

What Should You Do With a We Have Your Data Email?

Treat it as evidence, not as a conversation. For organizations, drawing on the CISA response checklist and the cases above:

1. Do not reply from the targeted inbox. Preserve the full message with headers and move response planning to a channel the attackers could not have seen.
2. Report it. CISA lists CISA itself, your local FBI field office, the FBI's IC3 and the Secret Service as reporting options.
3. Vet negotiators before an incident. Ask who will see your insurance limits and internal positions, and keep those documents out of the negotiation thread unless needed.
4. Run a sanctions check before any payment, and document it, given OFAC's strict liability stance.
5. Move SSO to phishing resistant MFA. GTIG recommends FIDO2 security keys and similar methods against the vishing that starts these attacks.

For individuals whose data appears in a leak, the rule is shorter: never pay or reply to an extortion email aimed at you personally, confirm any breach through the company's own notice, and change the password for that service and anywhere you reused it.

What Happens Next?

The next step, per the October 8 bail order, is a detention hearing in the Eastern District of Texas, and possibly an unsealed complaint that explains what the government actually alleges. The firms in this industry will be watching Texas for another reason: Krebs's sources say Dubrovsky may not be the last negotiation professional charged.