- Messages
- 4,004
- Likes
- 1,873
- Points
- 2,130
Edward Dubrovsky, a 54-year-old Canadian security specialist who worked with ransomware victims and helped companies negotiate with hackers, has been arrested in the United States. Media reports indicate his arrest may be connected to the investigation into the ShinyHunters hacking group and the recent FBI breach.
Late last week, FBI Director Kash Patel announced the arrest of another alleged ShinyHunters member. Although he did not disclose the suspect's name, The New York Times reported that he was a Canadian citizen arrested in Pennsylvania.
Shortly thereafter , Politico and renowned security journalist Brian Krebs reported Dubrovsky's arrest. According to Krebs's own sources, the arrest was related to the ShinyHunters investigation, although the FBI has not officially confirmed this information.
According to journalists, Dubrovsky was arrested on October 8, 2026, while attending the NetDiligence Cyber Risk Summit in Pennsylvania.
Previously, Dubrovsky held a senior position at the Canadian company CYPFER and also worked with CyberSteward (which journalists believe is a trade name for CYPFER). Both companies specialize in assisting victims of cyberattacks, including negotiating with ransomware operators and facilitating ransom payments.
Although some media initially identified Dubrovsky as a co-founder of CYPFER, after the publication of the publication, company representatives told Brian Krebs that Dubrovsky was not, in fact, its founder: he served as its managing director and left the company in November 2025.
It is also noteworthy that Dubrovsky is the author of the book "Cyber Extortion Strategic Response," dedicated to countering ransomware.
According to court documents , after his arrest, Dubrovsky appeared in court in Pennsylvania, and his case was later transferred to the Eastern District of Texas. He remains in custody. Dubrovsky is charged with conspiracy to commit extortion by threat of disclosure of confidential information, as well as conspiracy to commit extortion, in violation of the federal Hobbs Act, which prohibits extortion and other crimes affecting interstate or international commerce.
However, the bulk of the case materials are sealed, so it is unclear what exactly Dubrovsky is accused of and whether this investigation is directly related to the recent FBI hack.
The conflict between the hacker group ShinyHunters and the FBI began in late September, when hackers announced they had breached the FBIJobs.gov portal and stolen 2-3 terabytes of data, including the personal and medical information of all agency employees and applicants.
The group, however, did not demand a ransom: the attack on the FBI was allegedly retaliation for a previously published law enforcement report , which, according to the attackers, contained false information about ShinyHunters' activities. Specifically, the report claimed that the hacker group exaggerated the scale of its attacks, threatened victims and their families, engaged in swatting, and used harsh methods to pressure victims. The hackers categorically denied these accusations and initially gave the FBI a week to correct or remove the document.
After this, law enforcement increased pressure on the hackers. First, it was reported that a suspected ShinyHunters member known by the nickname Umbreon had been detained in the Netherlands , and then media reported the arrest of another suspected member of the group in Jordan. According to journalists, the suspect is cooperating with the FBI and helping investigators search for other members of the group.
Furthermore, in early October, FBI representatives publicly invited the remaining ShinyHunters members to surrender and claimed to know how to find them.
Notably, almost simultaneously, ShinyHunters representatives told 404 Media that they had no intention of publishing the data stolen from the FBI and had never planned to do so from the outset.
Late last week, FBI Director Kash Patel announced the arrest of another alleged ShinyHunters member. Although he did not disclose the suspect's name, The New York Times reported that he was a Canadian citizen arrested in Pennsylvania.
Shortly thereafter , Politico and renowned security journalist Brian Krebs reported Dubrovsky's arrest. According to Krebs's own sources, the arrest was related to the ShinyHunters investigation, although the FBI has not officially confirmed this information.
According to journalists, Dubrovsky was arrested on October 8, 2026, while attending the NetDiligence Cyber Risk Summit in Pennsylvania.
Previously, Dubrovsky held a senior position at the Canadian company CYPFER and also worked with CyberSteward (which journalists believe is a trade name for CYPFER). Both companies specialize in assisting victims of cyberattacks, including negotiating with ransomware operators and facilitating ransom payments.
Although some media initially identified Dubrovsky as a co-founder of CYPFER, after the publication of the publication, company representatives told Brian Krebs that Dubrovsky was not, in fact, its founder: he served as its managing director and left the company in November 2025.
It is also noteworthy that Dubrovsky is the author of the book "Cyber Extortion Strategic Response," dedicated to countering ransomware.
According to court documents , after his arrest, Dubrovsky appeared in court in Pennsylvania, and his case was later transferred to the Eastern District of Texas. He remains in custody. Dubrovsky is charged with conspiracy to commit extortion by threat of disclosure of confidential information, as well as conspiracy to commit extortion, in violation of the federal Hobbs Act, which prohibits extortion and other crimes affecting interstate or international commerce.
However, the bulk of the case materials are sealed, so it is unclear what exactly Dubrovsky is accused of and whether this investigation is directly related to the recent FBI hack.
The conflict between the hacker group ShinyHunters and the FBI began in late September, when hackers announced they had breached the FBIJobs.gov portal and stolen 2-3 terabytes of data, including the personal and medical information of all agency employees and applicants.
The group, however, did not demand a ransom: the attack on the FBI was allegedly retaliation for a previously published law enforcement report , which, according to the attackers, contained false information about ShinyHunters' activities. Specifically, the report claimed that the hacker group exaggerated the scale of its attacks, threatened victims and their families, engaged in swatting, and used harsh methods to pressure victims. The hackers categorically denied these accusations and initially gave the FBI a week to correct or remove the document.
After this, law enforcement increased pressure on the hackers. First, it was reported that a suspected ShinyHunters member known by the nickname Umbreon had been detained in the Netherlands , and then media reported the arrest of another suspected member of the group in Jordan. According to journalists, the suspect is cooperating with the FBI and helping investigators search for other members of the group.
Furthermore, in early October, FBI representatives publicly invited the remaining ShinyHunters members to surrender and claimed to know how to find them.
Notably, almost simultaneously, ShinyHunters representatives told 404 Media that they had no intention of publishing the data stolen from the FBI and had never planned to do so from the outset.
| "This is all a marketing campaign aimed at protecting our business and actively combating misinformation," a ShinyHunters representative told the publication. "If we had made the announcement in a conventional manner, it would never have drawn so much attention to our words and intentions." |