Canadian Cybersecurity Executive Charged in Federal Extortion Case
_(53840386529).jpg){kind=link}
FBI agents arrested Edward Dubrovsky on October 8 in Pennsylvania, charging him with conspiracy to threaten the confidentiality of information with intent to extort money and interference with commerce by threats. Federal court records show the case has been moved to the Eastern District of Texas. KrebsOnSecurity reports the arrest occurred during a cyber insurance conference and that the investigation centers on the ShinyHunters group, which the FBI says has extorted more than $70 million from victims this year. Dubrovsky, who worked in ransomware negotiation and authored a book on cyber extortion response, is currently held at a federal facility in Philadelphia.
The Arrest and Charges
FBI agents arrested Edward Dubrovsky on October 8 in Pennsylvania. Federal court records list charges including conspiracy to threaten confidentiality of information with intent to extort money and interference with commerce by threats. The core complaint and several related documents are sealed.
The U.S. Bureau of Prisons website shows that a 54-year-old Edward Dubrovsky is held at a federal facility in Philadelphia. A notice filed October 9 moved the case to the Eastern District of Texas, where sources say the ShinyHunters investigation is now centralized. Available court records show Dubrovsky does not currently have an attorney and has not yet been appointed a public defender.
Professional Background
Dubrovsky's LinkedIn profile identified him as associated with CyberSteward, a Canadian firm. A spokesperson for Cypfer stated that Dubrovsky served as a managing director before resigning in November 2025, and was not a founder as his profile claimed. His LinkedIn post from approximately one month before his arrest indicated he planned to attend the Cyber Risk Summit.
Dubrovsky authored a book titled Cyber Extortion Strategic Response. The book states that communicating with a criminal is not the same as negotiating a payment, and that engagement can serve objectives including testing claims, gathering information and creating time for decision-making. KrebsOnSecurity sources describe his firm as specializing in ransomware negotiations with cybercrime groups.
ShinyHunters Operations
ShinyHunters typically uses phishing and stolen credentials to extract data from software-as-a-service company accounts, then threatens to publish stolen information unless victims pay a ransom. The FBI reports the group has extorted more than $70 million from victims this year. Targets have included the FBI's online recruitment portal, from which the group allegedly stole data on thousands of agents including medical and psychiatric records.
Dutch police arrested convicted cybercriminal Pepijn van der Stap last month as part of the ShinyHunters investigation. Sources reported that FBI investigators have been analyzing devices seized during that arrest. A teenager named Saif Al-din Khader, known as Rey and identified as another member, was detained and is reportedly cooperating with investigators.
Investigation Developments
Multiple sources told KrebsOnSecurity that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas. An arrest took place during the Cyber Risk Summit, held at the Loews Philadelphia Hotel between October 5 and October 7.
Sources also told KrebsOnSecurity that charges against principals at other companies that specialize in ransomware negotiation may be forthcoming. The FBI has declined to comment on the investigation. After Van der Stap's arrest, another ShinyHunters member named Rey assumed control over the group and began taunting the FBI over stolen agency data.
Legal Boundary Questions
The arrest of a ransomware negotiation executive raises questions about the boundary between legitimate consulting and potential conspiracy with extortion groups. Companies facing data theft often hire intermediary firms because direct contact with criminals carries legal and operational risks. The charges filed against Dubrovsky include conspiracy to threaten confidentiality of information with intent to extort money.
The New York Times reported the arrest but did not identify the man, nor did a statement from FBI Director Kash Patel. Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling) was arrested on cyber extortion and conspiracy charges. The nature of any alleged assistance remains unclear in public filings.
Steps for Organizations Facing Extortion
Contact law enforcement immediately when you discover a data breach or receive an extortion demand. Engage incident response professionals and verify their credentials before sharing sensitive information. Document all communications with attackers and preserve evidence of the intrusion. Review your cybersecurity controls and access logs to understand how the breach occurred. Consult legal counsel familiar with cybercrime cases before making decisions about ransom payment or negotiation.
- Contact law enforcement immediately when you discover a breach or extortion demand
- Engage incident response professionals and verify their credentials
- Document all communications and preserve evidence
- Review cybersecurity controls and access logs
- Consult legal counsel before deciding on ransom payment or negotiation
Questions readers ask
Why was Edward Dubrovsky arrested?
Federal agents arrested Dubrovsky on October 8 on charges of conspiracy to threaten confidentiality of information with intent to extort money, and interference with commerce by threats. The arrest is linked to the FBI's investigation of the ShinyHunters hacking group. Many details remain sealed in court records.
What is ShinyHunters accused of doing?
ShinyHunters typically uses phishing and stolen credentials to extract data from software-as-a-service company accounts, then threatens to publish stolen information unless victims pay a ransom. The FBI reports the group has extorted more than $70 million from victims this year.
Where is the case being prosecuted?
A notice filed October 9 moved the case to the Eastern District of Texas. Multiple sources told KrebsOnSecurity that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas. The U.S. Bureau of Prisons website shows that a 54-year-old Edward Dubrovsky is being held at a federal facility in Philadelphia.
Are additional arrests expected?
Sources told KrebsOnSecurity that charges against principals at other companies specializing in ransomware negotiation may be forthcoming. The FBI has been analyzing devices seized during the arrest of Pepijn van der Stap. Another member, teenager Saif Al-din Khader, is reportedly cooperating with investigators.
What should companies do when facing ransomware?
Contact law enforcement immediately and engage incident response professionals with verified credentials. Document all communications and preserve evidence. Consult legal counsel before making decisions about ransom payment. Review cybersecurity controls to understand how the breach occurred.
Source and reporting limits
Based on reporting by KrebsOnSecurity. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.