ShinyHunters: ransom negotiator arrested in the US

The FBI investigation into ShinyHunters, the group that in September stole data on FBI personnel through an unpatched Oracle PeopleSoft system, has led to a third arrest. This time the suspect is not a young cybercriminal but an industry professional: a Canadian executive who specialises in negotiating ransoms on behalf of victims.

What happened

On 8 October 2026 a Canadian citizen was arrested in Philadelphia, Pennsylvania, where he was attending a cyber risk and insurance conference. On 9 October FBI Director Kash Patel announced on X the arrest of “another suspected co-conspirator” of ShinyHunters, without naming him, and noted that the FBIJobs.gov incident took place on a platform managed by a third-party vendor.

The New York Times was first to report that the person arrested was a Canadian detained in Pennsylvania. Politico, KrebsOnSecurity and Reuters identify him as Edward Dubrovsky, 54, based in Toronto. Court records spell his surname in different ways (Dobrovsky, Dobrosky) and, according to KrebsOnSecurity, do not yet list an attorney. According to SecurityWeek, the Royal Canadian Mounted Police (RCMP) told CBS News it is aware of the arrest of a Canadian in connection with ShinyHunters.

The profile described by the press is that of an extortion response expert:

• co-founder of CYPFER, a Canadian firm that assists ransomware victims; CyberScoop describes him as its former chief operating officer, Infosecurity Magazine as a former managing director;
• associated with CyberSteward, a Toronto firm specialising in negotiations with extortionists; according to Politico it is a trade name used by CYPFER;
• author of a book on strategic response to cyber extortion, released last month.

The FBI has not confirmed that Dubrovsky is the co-conspirator Patel referred to. The main complaint is sealed: it is not known what exactly he is accused of, nor whether the case concerns the attack on the FBI. Neither Dubrovsky nor CYPFER responded to requests for comment. He is presumed innocent until proven guilty.

The charges and the proceedings

The case docket, quoted by BleepingComputer, lists two counts:

• 18 U.S.C. § 371 and § 1030(a)(7)(B): conspiracy to threaten to impair the confidentiality of information with intent to extort money, the federal computer fraud provision that covers threats involving stolen data;
• 18 U.S.C. § 1951(a) and (b)(2): interference with commerce by threats and conspiracy to commit extortion (Hobbs Act).

After his appearance before the Eastern District of Pennsylvania, an order dated 9 October transferred the case to the Eastern District of Texas, where the charges were filed and where, according to KrebsOnSecurity’s sources, the FBI’s ShinyHunters investigation is focused. Dubrovsky remains in custody pending a detention hearing.

The wider investigation

Compared with what was already known, the sources add a few elements:

• Third arrest: after the arrest in the Netherlands on 15 September and the detention in Jordan in late September (a minor who is cooperating with the FBI), this is the first one in the United States.
• Other negotiators: according to KrebsOnSecurity’s sources, cited by SecurityWeek and Security Affairs, executives at other ransom negotiation firms could also face charges.
• Scale: according to the FBI, quoted by BleepingComputer, ShinyHunters and associated actors have breached more than 140 organisations and collected over 70 million dollars in a year.
• Lateral movement: only Infosecurity Magazine reports that, after getting in through PeopleSoft, the group moved to the FBI’s AWS GovCloud servers and extracted 2–3 TB of data. No other source confirms this.
• Infrastructure: according to SecurityWeek, the group’s Tor site is no longer reachable; according to The Register, the channels used to contact the group are also offline, although it claims the site will return. The Register also points out that ShinyHunters is now more a brand than a closed group: arrests do not necessarily stop its activity.

Why it matters for European and Italian companies

Without knowing what the charges allege, the case touches a sensitive point of incident response: whoever deals with extortionists on behalf of the victim sees everything. Stolen data, internal communications, insurance cover, ability to pay. Incident response and negotiation firms are suppliers with privileged access, called in at the moment of greatest pressure and often chosen in a hurry.

For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), supply chain security also covers these suppliers. If they receive personal data, an agreement under Article 28 of the GDPR and appropriate controls are needed, as for any other data processor. In healthcare, where stolen data often falls into special categories, the risk is even higher.

What to do now

1. Choose your response providers in advance: identify incident response and negotiation firms before you need them, checking ownership, references and staff, even when your insurer proposes them.
2. Put the rules in the contract: confidentiality, a GDPR agreement, no contact with attackers without your approval, and a full copy of every message exchanged.
3. Restrict external access: named, temporary accounts, multi-factor authentication, activity logging and revocation at the end of the engagement.
4. Keep control of the channel with the extortionist: communications must also go through your legal counsel and security lead, never through a single external party. Involve law enforcement and, for NIS2 entities, notify the national CSIRT (in Italy, CSIRT Italia at ACN).
5. Check claims against your own data: compare what the extortionists claim with access logs and outbound volumes. Claims can be inflated to raise the demand.
6. Don’t lower your guard: the group’s site is down, but the brand remains active. Keep the measures listed in our previous article, starting with PeopleSoft updates and multi-factor authentication on SaaS platforms.

How ARXDOME helps

ARX Sentry collects logs from computers, servers and firewalls, which help you know who accessed what and when, including the accounts of external suppliers. ARX Trace reconstructs the facts with the evidence collected by the probes, so you can verify extortionists’ claims instead of taking their word for it. ARX Retain keeps logs on European storage with object lock and legal hold, and returns them when you need them for an investigation or an audit.

Last updated: 12 October 2026