A Canadian cybersecurity executive who built his career helping organizations respond to ransomware attacks and negotiate with cybercriminals has been arrested on federal extortion charges, with multiple reports linking the case to the FBI’s ongoing investigation into ShinyHunters.
Edward Dubrovsky, 54, was arrested in Pennsylvania on October 8 and appeared in federal court in Philadelphia. Court records show he faces conspiracy and extortion-related charges involving threats to disclose confidential information and interference with commerce.
The arrest comes as the FBI intensifies its investigation into ShinyHunters, the hacking and extortion group that claimed responsibility for a September cyberattack involving FBI recruitment infrastructure and sensitive personnel information.
FBI Director Kash Patel announced on October 9 that agents had arrested another suspected ShinyHunters co-conspirator, although he did not publicly identify the individual.
KrebsOnSecurity subsequently identified Dubrovsky as the arrested executive, citing sources familiar with the investigation. CNN independently confirmed through multiple sources that Dubrovsky is believed to be connected to the FBI breach investigation.
The FBI has not publicly identified Dubrovsky as the suspect referenced by Patel or disclosed his alleged role in the intrusion. The underlying criminal complaint remains sealed.
Cybersecurity executive faces federal extortion charges
Federal court records show that Dubrovsky was taken into custody on October 8 in the Eastern District of Pennsylvania.
The publicly available docket identifies allegations involving conspiracy to threaten the confidentiality of information with the intent to extort money, along with interference with commerce through threats under the Hobbs Act.
According to BleepingComputer, the docket references federal statutes governing computer-related extortion and conspiracy.
Dubrovsky appeared before a federal magistrate judge in Philadelphia, where a public defender was appointed to represent him.
The case was subsequently transferred to the Eastern District of Texas, where prosecutors are seeking his continued detention pending trial.
Some initial court documents incorrectly spelled his surname as “Dobrovsky.” CNN reported that a federal law enforcement official confirmed the correct spelling as Dubrovsky.
The criminal complaint detailing the government’s allegations remains sealed, preventing independent examination of the specific conduct prosecutors believe occurred.
As a result, it remains unclear whether the charges concern the FBIJobs.gov intrusion itself, other ShinyHunters-related extortion activity or additional incidents under investigation.
Dubrovsky has not been convicted of the alleged offenses, and the charges remain allegations.
Dubrovsky previously helped companies negotiate with ransomware groups
The arrest has attracted particular attention because of Dubrovsky’s extensive professional background in cybersecurity incident response and ransomware negotiations.
Dubrovsky previously held senior positions at Canadian cybersecurity companies specializing in helping organizations respond to data breaches, ransomware attacks and cyber extortion.
According to Nextgov/FCW, he joined Cypfer in 2022 to lead consulting and threat intelligence operations and later served in senior executive roles, including chief operating officer and managing partner.
Before joining Cypfer, Dubrovsky held leadership positions at Cytelligence, a cybersecurity company acquired by Aon in 2020.
His professional experience also included advising corporate executives, attorneys and insurance providers on cybersecurity incidents and teaching cybersecurity-related courses.
More recently, Dubrovsky was associated with CyberSteward, a company involved in ransomware negotiation and cyber-extortion response services.
He also authored a book titled Cyber Extortion Strategic Response, which discusses how organizations should approach ransomware demands, negotiations and recovery decisions.
His professional background is notable given the nature of the federal charges, although it does not establish that his legitimate incident-response work was connected to criminal activity.
Cypfer disputes reports that Dubrovsky founded the company
Early reporting described Dubrovsky as a founder or co-founder of Cypfer, apparently based in part on information appearing in his professional profile.
However, KrebsOnSecurity updated its original investigation on October 10 after receiving a clarification from a Cypfer spokesperson.
According to the company, Dubrovsky was not a founder or co-founder. Cypfer said he served as a managing director before resigning in November 2025.
The clarification is significant because several reports about the arrest initially identified Dubrovsky as a company founder.
There is no public evidence that Cypfer itself has been charged with wrongdoing in connection with Dubrovsky’s arrest.
Arrest followed cybersecurity conference in Philadelphia
Dubrovsky’s arrest reportedly occurred shortly after a cybersecurity industry conference in Philadelphia.
KrebsOnSecurity reported that Dubrovsky had traveled to Pennsylvania around the time of the NetDiligence Cyber Risk Summit, which took place at the Loews Philadelphia Hotel from October 5 through October 7.
Both Cypfer and CyberSteward were associated with the event.
In a LinkedIn post published before the conference, Dubrovsky indicated that he planned to attend with members of the CyberSteward team and discuss ransomware negotiations and cyber-extortion advisory services.
Federal authorities arrested him on October 8, one day after the conference concluded.
The available court records do not establish that the conference itself played any role in the alleged offenses or the investigation.
FBI director confirms another ShinyHunters-related arrest
The arrest occurred as the FBI publicly announced another breakthrough in its investigation into ShinyHunters.
On October 9, FBI Director Kash Patel said agents had arrested another suspected co-conspirator associated with the group.
Patel described the arrest as part of an ongoing effort to dismantle the network and identify additional participants.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” Patel said in a statement reported by CBS News.
CBS News reported that the suspect was a Canadian citizen arrested in Pennsylvania. A law enforcement source told the outlet that the individual was believed to have been directly involved in the FBIJobs.gov intrusion.
The Royal Canadian Mounted Police separately acknowledged that a Canadian citizen had been arrested in the United States in connection with the ShinyHunters investigation.
However, the FBI did not identify the suspect in its announcement, and the publicly available court records do not establish Dubrovsky’s alleged role in the FBI breach.
CNN subsequently reported that multiple sources familiar with the investigation independently connected Dubrovsky to the case.
Investigation follows major theft of FBI personnel information
The arrest comes less than three weeks after ShinyHunters publicly claimed responsibility for compromising FBI recruitment infrastructure.
As BreachNews previously reported, the FBI began investigating unauthorized activity affecting FBIJobs.gov after ShinyHunters claimed it had exploited vulnerabilities involving Oracle PeopleSoft.
The group claimed it obtained between 2 TB and 3 TB of information involving current and former FBI employees, job applicants and internal records.
Although the full volume of allegedly stolen information has not been independently verified, subsequent reporting established that sensitive FBI personnel records were compromised.
Material examined by journalists reportedly included names, home addresses, Social Security numbers, medical information and details concerning personnel involved in intelligence and counterintelligence operations.
Some of the exposed records reportedly identified employees assigned to sensitive investigations involving foreign intelligence threats.
BreachNews subsequently reported on internal FBI communications acknowledging the exposure of employee information as investigators worked to determine the full scope of the incident.
The complete extent of the intrusion and the total number of affected individuals remain unresolved.
FBI investigation identified missed PeopleSoft security patch
Investigators have also made progress determining how the attackers initially compromised the recruitment environment.
Earlier this month, FBI Cyber Division Assistant Director Brett Leatherman said a third-party contractor failed to install a security patch that had been issued to protect the affected platform.
Reuters subsequently identified the contractor’s employer as Accenture and the affected technology as Oracle PeopleSoft, citing sources familiar with the investigation.
The FBI said it removed the contractor and implemented additional measures to reduce further risk.
The finding substantially corroborates ShinyHunters’ earlier claims that PeopleSoft was involved in the intrusion, although the bureau has not publicly identified the exact vulnerability exploited.
Oracle previously released an emergency security update addressing CVE-2026-35273, a critical PeopleSoft vulnerability that ShinyHunters had been linked to exploiting against other organizations.
However, the FBI has not confirmed that this was the specific vulnerability left unpatched in its recruitment environment.
ShinyHunters also claimed to have exploited another previously unknown PeopleSoft vulnerability. That additional zero-day claim remains unverified.
Arrest adds to international crackdown on ShinyHunters
Dubrovsky’s arrest follows several other developments in an increasingly international investigation into ShinyHunters.
In September, Dutch authorities arrested 24-year-old Pepijn van der Stap as part of an investigation into the hacking group.
The FBI subsequently described the Dutch suspect as one of the alleged leaders of ShinyHunters, although his specific alleged involvement in the FBIJobs.gov intrusion has not been publicly established.
Following the arrest, FBI Cyber Division Assistant Director Brett Leatherman issued a public warning to remaining ShinyHunters members, urging them to contact authorities before investigators identified them independently.
Leatherman said the FBI was continuing to collect evidence and identify people associated with the operation.
The bureau has said ShinyHunters and alleged co-conspirators compromised more than 140 organizations since 2025 and received at least $70 million through extortion.
Authorities in Jordan also recently detained a suspected ShinyHunters member.
Reuters reported that Khader was providing information potentially useful in identifying additional people associated with ShinyHunters. Jordanian authorities confirmed an arrest but did not publicly identify the detainee or independently confirm the reported cooperation.
The FBI has not publicly explained whether evidence obtained during the Dutch or Jordanian investigations contributed to Dubrovsky’s arrest.
Sealed complaint leaves key questions unanswered
The arrest of a cybersecurity executive with extensive experience negotiating ransomware demands introduces an unusual element to the ShinyHunters investigation.
However, the available evidence does not establish that Dubrovsky participated in the FBIJobs.gov intrusion, assisted ShinyHunters in stealing FBI information or improperly used his professional position.
Those questions remain unanswered while the criminal complaint is sealed.
Investigators have also not publicly disclosed whether Dubrovsky is accused of acting as a direct participant in cyber extortion, facilitating activity by other individuals or engaging in conduct unrelated to the FBI breach.
KrebsOnSecurity reported that investigators were examining devices seized during the Dutch investigation and that additional charges involving individuals associated with ransomware negotiation businesses could follow, citing sources familiar with the matter.
That possibility remains unconfirmed, and no additional individuals or companies should be considered implicated solely because of their involvement in legitimate ransomware negotiation services.
The case has been transferred to the Eastern District of Texas, where further court proceedings may provide additional information about the government’s allegations.
For now, Dubrovsky’s arrest represents another significant development in the FBI’s international investigation into ShinyHunters, while the precise allegations connecting him to the broader hacking operation remain undisclosed.
