FBI Arrests Canadian Cybersecurity Executive in ShinyHunters Case

A Canadian cybersecurity executive known for negotiating with ransomware attackers has been arrested in the United States as investigators pursue suspected connections to ShinyHunters, a hacking group accused of stealing sensitive information from the FBI. Court records identify Edward Dubrovsky as facing two criminal charges related to extortion and threats, although the allegations have not been proven in court.

FBI Director Kash Patel confirmed the arrest on Friday, describing the suspect as a suspected co-conspirator in the investigation. Reuters subsequently identified the arrested individual as Dubrovsky, whose professional career spans decades in cybersecurity and cyberextortion negotiations.

According to the U.S. District Court for the Eastern District of Pennsylvania, the charges are conspiracy to threaten to impair the confidentiality of information with the intent to extort money and interference with commerce by threats. Federal detention records identify a 54-year-old Edward Dubrovsky as being held in Philadelphia. The partially sealed court documents contain different spellings of the surname, including Dobrosky and Dobrovsky, and do not establish his profession or employer.

Patel said the investigation would continue to target the hacking network and its associates.

"We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," said Kash Patel, FBI director.

The FBI has linked its investigation to a breach of FBIjobs.gov that exposed sensitive information concerning bureau personnel. In September, ShinyHunters claimed responsibility for stealing information that the bureau said could involve tens of thousands of employees and job applicants, including personal details and Social Security numbers.

Cybersecurity professionals expressed surprise at Dubrovsky's arrest, citing his established reputation in the industry while emphasizing that the charges remain allegations. Toronto-based technology and cybersecurity analyst Ritesh Kotak described the reaction among professionals as unexpected.

"For the cybersecurity community in general, I think that there's a sense of shock," said Ritesh Kotak, a technology and cybersecurity analyst.

Kotak said Dubrovsky had spoken at numerous industry conferences and was widely recognized for his work negotiating with ransomware attackers. He also cautioned against drawing conclusions before the allegations are tested in court.

"This is an individual that was for the most part respected when it came to ransomware negotiations," said Ritesh Kotak.

David Shipley, chief executive of Fredericton-based Beauceron Security, said the attack on the FBI appeared to have intensified pressure on the hacking group. ShinyHunters has conducted numerous data breaches since 2019 and has targeted organizations across several industries.

"I don't think anyone saw this twist coming," said David Shipley, chief executive of Beauceron Security.

Shipley said the group's decision to target the FBI had prompted an extensive law enforcement response. The group has also been associated with attacks affecting Canadian telecommunications company Telus, Microsoft, Ticketmaster and Rockstar Games, among other organizations.

In March, Telus said it was investigating unauthorized access involving a technology business line it had recently reacquired. BleepingComputer reported that ShinyHunters claimed to have stolen nearly one petabyte of data from Telus Digital, including customer information, and demanded payment to prevent its release.

Dubrovsky's professional profile describes extensive experience in cybersecurity leadership, incident recovery and ransomware negotiations. In 2022, cybersecurity firm CYPFER announced his appointment as managing director, describing him as a veteran of the cybersecurity and technology industries who had helped thousands of organizations recover from cyberattacks. His LinkedIn profile indicates that he left the company almost a year ago.

Dubrovsky attended the NetDiligence conference in Philadelphia in October with CyberSteward, according to his professional posts and photographs shared by the company. His recently published book addresses cyberextortion and strategies for managing ransomware crises.

"We must understand our opponents if we expect to survive on the digital battleground, and we must understand them better if we hope to reach common ground in negotiations," Dubrovsky wrote in the book.

The Royal Canadian Mounted Police confirmed awareness of the arrest but referred further questions to the FBI. The FBI declined to comment specifically on Dubrovsky's case, and CyberSteward did not respond to requests for comment. Global Affairs Canada also did not respond to a request for comment.