FBI arrests Canadian cybersecurity executive in ShinyHunters investigation

The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 9, 2026, charging him with extortion and interfering with interstate commerce. Federal investigators allege Dubrovsky learned that ShinyHunters had stolen personnel data from the FBI’s recruitment portal in late September but did not inform the bureau before the group threatened to publish it. The FBI suspects executives at two ransomware negotiation firms conspired with the cartel.

Shinywire was active from May 3 to October 16, 2026, and listed nearly 100 hacked organizations. The site displayed stolen file samples to pressure victims and directed them to private links for direct contact with ShinyHunters. Victims who failed to engage within seven days faced publication of their data on a Tor-based leak site. Intuitive Surgical, breached in March 2026 via a phishing email, was among the targeted companies.

Dubrovsky published a book in 2026 that advised victims to always communicate with hackers during ransomware negotiations. His book marketing included the statement, “Communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay.” Before his arrest, Dubrovsky was a business partner with Daniel Tobok at Cypfer, a cybersecurity firm, until 2024, when he accused Tobok of excluding him from business decisions; Tobok, a former Cypfer CEO, went by Ghostbyte in ransomware circles and had negotiated with the Dharma ransom cartel in 2018. Cypfer later denied involvement in ransomware payments and stated it was unaware of Dubrovsky’s arrest until media reports.

Dutch police arrested member Pepijn van der Stap on September 15, 2026, accessing his Signal chats that revealed communications with ransomware negotiators in Canada and the US. Jordanian authorities detained Rey on September 29, 2026, and he later cooperated with the FBI. The group has extorted more than $70 million in 2026 alone, according to the FBI.

ShinyHunters has a history of large-scale breaches, including the December 2024 attack on PowerSchool, where it stole data on 62 million students and 9.5 million teachers before a $2.85 million ransom was paid. Dutch police also alleged that Pepijn van der Stap ordered two murders abroad, though there is no evidence the orders were carried out. The cartel used Shinywire for private negotiations and a Tor-based site for public exposure.

In late September 2026, ShinyHunters breached the FBI’s recruitment website, fbijobs.gov, stealing sensitive personnel data that included medical records, Social Security numbers, and home addresses. The FBI’s investigation accelerated after the breach, and the agency confirmed several arrests while declining to identify every suspect.

The US Department of Justice charged MonsterCloud CEO Zohar Pinhasi on October 7, 2026, with wire fraud and conspiracy for secretly paying hackers while charging victims higher fees. Pinhasi allegedly paid $8 million to ransomware groups while billing clients $19 million. Angelo Martino, another negotiator, was sentenced to 70 months in prison in July 2026 for conspiring with the Blackcat/ALPHV ransomware group and providing confidential victim information to maximize ransom demands.

Ransomware negotiators face scrutiny over potential conflicts of interest, as some firms charge a percentage of ransom payments, creating financial incentives that may align negotiators’ interests with those of attackers. In May 2026, ShinyHunters publicly complained on Telegram that Coveware’s advice against paying ransoms was reducing their payment success rate. The FBI warned victims in May 2026 not to pay ShinyHunters, citing the cartel’s practice of reselling or reusing stolen data rather than destroying it.

The FBI has not publicly identified the US-based consulting firm executive allegedly operating Shinywire. The FBI suspects that executive knew details about new ShinyHunters victims before the victims themselves were aware of breaches.