FBI Arrests Canadian Ransomware Negotiator in ShinyHunters Crackdown
The FBI has arrested a third person linked to the ShinyHunters hacking operation. The suspect, Edward Dubrovsky, built his career on the opposite side of these attacks: helping organizations talk down ransom demands.
The FBI has arrested a third suspect tied to the ShinyHunters hacking operation, and this one is a peculiar choice for a cybercrime case. According to court records, reporting by The New York Times, KrebsOnSecurity, and SecurityWeek, the suspect is Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive. He was arrested in Pennsylvania on October 8 after arriving for a cybersecurity conference, and his case was subsequently moved to the Eastern District of Texas, which sources describe as the epicenter of the FBI's ShinyHunters investigation.
Dubrovsky did not build his career breaking into systems. He spent it defending against them, holding senior roles at cybersecurity firms that help data-breach and ransomware victims negotiate extortion payments with the criminals who demand them. Federal court records show he was arrested under several charges, including conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and Hobbs Act extortion charges and conspiracy. The core of the complaint remains sealed, so his specific conduct — and his exact role in the ShinyHunters operations — has not been publicly established.
A third arrest, and the first in this role
FBI Director Kash Patel announced the arrest on October 9, saying agents had taken custody of "another suspected co-conspirator of the ShinyHunters group." The New York Times reported the man was a Canadian citizen considered a primary co-conspirator in the recent breach. The Royal Canadian Mounted Police confirmed to CBS News that it was aware of the arrest of a Canadian in the United States in connection with ShinyHunters, though the FBI has not publicly confirmed Dubrovsky's identity as the arrested co-conspirator.
This is the latest in a series of arrests against the group. In September, Dutch High Tech Crime Unit authorities — with FBI support — arrested one of ShinyHunters' alleged leaders. According to the FBI's Cyber Division, ShinyHunters has allegedly breached more than 140 organizations and collected at least $70 million in extortion payments since last year, targeting victims in the United States, the Netherlands, and elsewhere.
Why an insider profile matters
The context matters because ShinyHunters gained prominence through a September breach of the FBI's public jobs portal, which exposed sensitive personal information about thousands of current and former FBI employees. The group had threatened to release the data unless the FBI amended an earlier advisory it claimed mischaracterized its tactics — a demand officials read as a threat to publish the stolen trove — before backing off.
A ransomware negotiator in the mix changes the shape of the case. Negotiators sit at the intersection of victims and extortionists: they hear tactics, pressure language, and deadlines first-hand, and they know how ransom demands are structured and enforced. If Dubrovsky's arrest reflects the kind of sourcing KrebsOnSecurity describes, the FBI appears to be probing a bridge between the ShinyHunters operation and the extortion market, not just the intrusion itself. Because the complaint is sealed, the strength of the evidence remains private, and the charges should be read as allegations, not findings.
Key facts, verified versus unverified
- Verified: Edward Dubrovsky, 54, a Canadian cybersecurity executive, was arrested in Pennsylvania on October 8, and his case was moved to the Eastern District of Texas.
- Verified: charges include conspiracy to threaten to impair the confidentiality of information to extort money, and Hobbs Act extortion.
- Verified: FBI Director Kash Patel announced the arrest of "another suspected co-conspirator" on October 9; the RCMP confirmed it is aware of the Canadian's arrest.
- Verified: ShinyHunters claims the September FBI jobs-portal breach; the FBI says the group has breached 140+ organizations for $70 million in extortion.
- Unverified: Dubrovsky's specific role in the ShinyHunters operation — the core complaint is sealed, and the FBI has not publicly confirmed his identity in the case.
What this means for you
If your organization gets hit by ransomware, the people who answer the phone — negotiators, incident responders, insurers — are now a place where law enforcement looks for leads. That does not make them suspects, but it does mean their communications and relationships can carry evidentiary weight. Keep your records of extortion demands, contact channels, and negotiation correspondence clean and well-documented. And if you operate in ransomware response, be aware that your industry position makes you visible in an ongoing, multi-jurisdiction investigation; your conduct may be scrutinized long after the news cycle moves on.
Sources: SecurityWeek: Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe; Krebs on Security: FBI Arrests Executive at Ransomware Negotiation Firm; BleepingComputer: Cyber exec arrested in case allegedly tied to ShinyHunters hackers.
Corrections: Report an error at corrections@wireshaman.com.