A Canadian cybersecurity executive whose work involved negotiating with ransomware operators has been arrested on federal extortion-related charges amid a widening FBI investigation into ShinyHunters, a hacking and data-extortion network. Edward Dubrovsky, 54, was taken into custody in Pennsylvania on Thursday, October 8, while visiting Philadelphia for a cybersecurity conference, according to Reuters and investigative journalist Brian Krebs.
The following day, FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator, believed to be connected to the recent breach of the bureau's recruitment platform. Patel did not identify the suspect. When Reuters enquired about Dubrovsky, the FBI referred the news agency to Patel's announcement but declined to confirm whether he was the individual concerned.
Federal court records accuse Dubrovsky of conspiring to extort money by threatening to disclose confidential information. He also faces an extortion-related charge under the US Hobbs Act. The underlying criminal complaint remains sealed, leaving the precise allegations, the identity of any victims and the evidence supporting the case undisclosed.
Dubrovsky appeared before Magistrate Judge Scott W. Reid in the Eastern District of Pennsylvania on October 8. He was detained pending further proceedings, and an order issued the following day directed US Marshals to transfer him to the Eastern District of Texas, where the case originated.
Dubrovsky's professional background makes the arrest particularly unusual. He previously served as managing director of CYPFER, a Canadian cybersecurity company specialising in ransomware response and recovery. The company confirmed he held the position from May 2022 until December 2025, while correcting earlier reports that he founded or co-founded the business.
Reuters also linked Dubrovsky to CyberSteward, which advertises specialist services for companies facing ransom demands and threats to publish stolen information. Such negotiations involve communicating with hackers on behalf of affected organisations, assessing demands and attempting to reach an agreement. Nothing publicly established about Dubrovsky's professional activities demonstrates his involvement in any particular cyberattack.
In September, the FBI's recruitment platform was breached, exposing sensitive personnel information. ShinyHunters claimed responsibility, as TheZeal previously reported, although the group's broader claims of access to other FBI systems remain unverified.
The investigation has also produced arrests overseas. Dutch authorities detained a suspected ShinyHunters associate identified by Reuters as Pepijn van der Stap, while Saif al-Din Khader, known online as "Rey", was detained in Jordan and reportedly began cooperating with investigators. TheZeal previously examined Khader's detention and his claims of having communicated with law enforcement long before his arrest.
The FBI alleges that ShinyHunters and associated operators have breached more than 140 organisations and obtained at least US$70 million in extortion payments since 2025. Activity under the ShinyHunters name has continued despite the arrests, while cybersecurity researchers describe an operation involving overlapping groups rather than a single organisation with fixed membership.
TheZeal also reported allegations that ShinyHunters had attempted to extort Jeppesen ForeFlight, the aviation technology business formerly owned by Boeing. No publicly available evidence establishes Dubrovsky's involvement in that alleged operation.
For now, the most consequential details of Dubrovsky's case remain concealed by the sealed complaint. Prosecutors have yet to disclose what he is alleged to have done, whether his arrest is directly connected to ShinyHunters, or what relationship, if any, the case has to the FBI intrusion.
