Canadian Cyber Exec Arrested In FBI ShinyHunters Crackdown

Federal agents have arrested Edward Dubrovsky, a Canadian cybersecurity executive, in a case that multiple reports link to the FBI's crackdown on ShinyHunters. Dubrovsky, 54, has held senior roles at firms that help data breach and ransomware victims negotiate extortion payments with cybercriminals. Authorities took him into custody in Pennsylvania, where he was attending a cybersecurity conference, according to reports from Politico and KrebsOnSecurity. The arrest follows a string of law enforcement actions against the extortion group since it breached FBI systems in September 2026.

FBI Director Kash Patel announced on October 9 that agents had arrested another suspected co-conspirator tied to the ShinyHunters extortion group. Patel did not name the suspect, but The New York Times reported that agents had detained a Canadian citizen in Pennsylvania. The newspaper also reported that investigators consider the suspect a primary co-conspirator in the recent intrusion targeting the FBI Jobs platform. Patel stated that the FBI will keep working with its partners "to disrupt what's left of the ShinyHunters group and their associates."

Court records show that Dubrovsky appeared before a magistrate judge in the Eastern District of Pennsylvania after agents took him into custody. A bail status order dated October 8 shows that the court appointed the Federal Defender to represent him after he requested counsel. The same order records that Dubrovsky stipulated to his identity and to probable cause, and elected to hold his detention hearing in the charging district. A later court order transferred him to the Eastern District of Texas, where prosecutors filed the charges, and states that he remains in custody.

The complaint against Dubrovsky remains under seal, although the case docket lists two sets of federal charges connected to extortion. The FBI has not publicly confirmed that Dubrovsky is the ShinyHunters co-conspirator that Patel described in his announcement on X. According to the docket, prosecutors in Texas have charged Dubrovsky with the following federal offenses, both of which carry extortion elements:

• Conspiracy to threaten to impair the confidentiality of information with intent to extort money, filed under 18 U.S.C. 371 and 1030(a)(7)(B).
• Interference with commerce by threats, covering both Hobbs Act extortion and conspiracy to commit Hobbs Act extortion, under 18 U.S.C. 1951(a) and (b)(2).

KrebsOnSecurity reported that multiple sources tied the arrest to the ShinyHunters investigation, although the sealed complaint leaves the exact allegations unclear. Observers still cannot determine what role prosecutors believe Dubrovsky played, or whether the case connects directly to the breach of FBI systems. As with any criminal complaint, the charges remain allegations, and the court must presume Dubrovsky innocent unless prosecutors prove their case.

Dubrovsky co-founded CYPFER, a Canadian cybersecurity company, and also worked with CyberSteward, a firm specializing in ransomware negotiation and extortion response. Politico reported that CYPFER uses CyberSteward as a trade name and that both brands help organizations negotiate and send payments to cybercriminals.

Dubrovsky also recently published a book titled Cyber Extortion Strategic Response, which covers how organizations should handle extortion demands from attackers. KrebsOnSecurity noted that he had posted on LinkedIn about plans to attend the NetDiligence Cyber Risk Summit in Pennsylvania alongside the CyberSteward team.

International Law Enforcement Has ShinyHunters in its Sights

The case raises uncomfortable questions for an industry that relies on trust, since negotiators often handle sensitive victim data and direct communication with criminals. Breached companies hire these specialists to verify stolen data, lower ransom demands, and arrange payments when executives decide that paying offers the least damaging option. Prosecutors have not publicly explained whether the alleged conduct relates to Dubrovsky's negotiation work, so the connection remains speculative.

ShinyHunters told BleepingComputer in September that it breached FBI systems by exploiting an alleged zero-day vulnerability in Oracle PeopleSoft software. The group claimed the flaw allowed remote code execution, enabling attackers to move laterally into FBI-managed AWS GovCloud infrastructure. The hackers also shared a screenshot showing the FBI Jobs website defaced with their Umbreon Pokémon logo and a claim that employee data was stolen.

According to the group, the FBI quickly detected the intrusion, took affected systems offline, and cut the gang's access to multiple networks simultaneously. Describing how quickly the agency responded once it spotted the attack, a ShinyHunters representative told BleepingComputer, "They literally pulled the plug on everything."

ShinyHunters claimed it stole between 2TB and 3TB of data, including records on current and former FBI employees and job applicants. 404 Media first reported the breach after receiving roughly 5,000 purported employee records, and it verified that some details in the sample were accurate. Data samples shared with BleepingComputer and other outlets confirmed that the breach exposed the following types of personal information about FBI staff:

• Home addresses and Social Security numbers belonging to FBI employees, which criminals could use for identity theft, targeted harassment, or fraud.
• Details about sensitive job assignments, which could reveal the roles and responsibilities of personnel working on confidential investigations and operations.
• Information about employees' family members, along with other personal data, extends the potential impact of the breach beyond the workforce.

The threat actors also claimed the stolen files contained medical and psychiatric records, but outlets have not independently verified that claim. An internal FBI memo cited by The New York Times showed that the agency assumed the breach had affected every one of its employees. The FBI later attributed the incident to a platform managed by a third-party contractor that had failed to install a security update. ShinyHunters later described the attack as retaliation for an FBI FLASH report published in May 2026 that detailed the group's tactics.

Dutch police arrested Pepijn van der Stap, a 24-year-old Amsterdam hacker previously known as Umbreon, on September 15 as part of the investigation. ShinyHunters denied any connection to van der Stap, and the group's main representative kept talking to reporters after his arrest. Soon afterward, the FBI took the unusual step of publicly urging ShinyHunters members to surrender while investigators continued to identify the group's participants. Brett Leatherman, the assistant director of the FBI Cyber Division, warned members that every arrest and infrastructure seizure revealed more about those still active.

Days later, Jordanian authorities reportedly detained a suspected member known online as Rey, whom Reuters identified as Saif al-Din Khader. Sources told Reuters that Khader began helping investigators locate other alleged members, cooperating with the FBI and international law enforcement agencies. In early October, the group's main Telegram representative stopped responding to journalists, and the account later vanished from the platform. The group's data leak site also went offline, although a new ShinyHunters leak site later appeared, suggesting that some members remain active.