Federal Bureau of Investigation agents have apprehended a Canadian executive from a cybersecurity firm specializing in ransomware negotiations in Pennsylvania, a move directly linked to an ongoing investigation into the notorious ShinyHunters hacking group. This high-profile arrest, confirmed by multiple sources to KrebsOnSecurity, follows a recent audacious data breach attributed to ShinyHunters, which compromised sensitive information belonging to thousands of FBI agents. The New York Times reported on the arrest of the Canadian national in Pennsylvania, citing suspicions of him aiding ShinyHunters. While the Times story and an official statement from FBI Director Kash Patel on Twitter/X did not disclose the individual’s identity, subsequent investigations by KrebsOnSecurity have shed significant light on the unfolding events.

Sources close to the investigation revealed that the arrested Canadian was in Pennsylvania attending a cyber insurance conference. His company, it is understood, focuses on managing ransomware negotiations with cybercrime syndicates. This detail is particularly crucial as it places the arrested individual at the nexus of both the ransomware threat landscape and the entities that attempt to mediate these crises. The FBI’s ShinyHunters investigation is reportedly centralized at an FBI field office in Texas, a strategic move to consolidate resources and intelligence for this complex cybercrime operation.

Further digging into the conference circuit revealed that the Cyber Risk Summit, where the arrested executive was present, took place at the Loews Philadelphia Hotel between October 5th and October 7th. The summit’s website lists Cypfer, a prominent Canadian security company, as its biggest sponsor. This sponsorship connection immediately drew attention to Cypfer and its associated personnel, particularly in light of the arrest.

A review of LinkedIn profiles identified Edward Dubrovsky as a former “ex-founder” of Cypfer. Dubrovsky is now associated with another Canadian security firm and conference sponsor, CyberSteward. Approximately a month prior to his arrest, Dubrovsky had publicly stated his intention to attend the Cyber Risk Summit with his CyberSteward colleagues, a statement that now carries significant weight in the context of the ongoing investigation.

In an update to the story, a spokesperson for Cypfer clarified that Dubrovsky was not a founder or co-founder as his LinkedIn profile suggested. Instead, he served as a managing director before his resignation in December 2025. This distinction, while seemingly minor, is important for accurately profiling the individuals involved and their precise roles within the cybersecurity industry.

The image accompanying the original report shows Edward Dubrovsky’s LinkedIn profile, highlighting his professional background. His LinkedIn profile also indicates his authorship of “Cyber Extortion Strategic Response,” a 252-page book that delves into the intricacies of ransomware negotiations. The book’s description promises to guide readers through the critical decision-making processes involved in responding to, recovering from, and protecting an organization in the face of a ransomware attack. The profile’s tagline, "Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic," further underscores his expertise in this highly specialized and often ethically ambiguous field.

Federal court records have since corroborated the arrest of an individual named Edward Dobrovsky (note the slight misspelling of the surname in the court documents) in Pennsylvania on charges of cyber extortion and conspiracy. While many of the related legal documents, including the core complaint, have been sealed, a subset of these documents has been indexed on Courtlistener.com. These publicly available records, including a summary of the complaint, detail charges such as "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." These charges suggest a direct link between the arrested individual and the methods employed by groups like ShinyHunters.

The image from Courtlistener.com visually represents the legal filings associated with the case, providing a tangible link to the charges faced by Dobrovsky. The U.S. Bureau of Prisons website’s inmate locator confirms that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia. However, court records indexed by CourtListener reveal a significant development: on October 9th, the case was transferred to the Eastern District of Texas. This move aligns with earlier reports that this FBI field office has become the central hub for the ShinyHunters investigation, indicating a concerted effort to bring all related threads together. The FBI, when approached for comment for this story, declined to provide any official statement.

Dubrovsky’s LinkedIn profile further elaborates on his expertise, stating he is the author of Cyber Extortion Strategic Response. This 252-page book offers a comprehensive look at navigating the complex landscape of ransomware attacks. An excerpt from the book’s Amazon listing highlights a critical distinction emphasized by Dubrovsky: "communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay." The excerpt continues, "Engagement can serve other objectives, including testing claims, gathering information, creating time, and preserving options while the organization evaluates its next move." This philosophical approach to cyber extortion underscores the nuanced strategies involved in dealing with ransomware demands, a field where Dubrovsky appears to have positioned himself as an authority.

Edward Dubrovsky was not immediately available for comment, and inquiries to other executives at CyberSteward have also not yet yielded a response. As of the latest available information, court records indicate that Dubrovsky does not currently have legal representation and has not yet been appointed a public defender. This suggests that the legal proceedings are in their early stages.

ShinyHunters, the hacking group at the center of this investigation, typically employs phishing tactics and the exploitation of stolen credentials to exfiltrate data from corporate accounts within Software-as-a-Service (SaaS) companies. Subsequently, they threaten to publicly release the pilfered data unless a ransom is paid. The FBI estimates that ShinyHunters has extorted over $70 million from its victims this year alone, highlighting the significant financial impact of their operations.

Sources familiar with the FBI’s efforts have revealed that agents are meticulously examining devices seized last month during the arrest of convicted cybercriminal Pepijn van der Stap in the Netherlands. Van der Stap was apprehended in connection with the ShinyHunters investigation, and the FBI is reportedly considering further charges against principals at other companies that specialize in ransomware negotiation services. This indicates a broader sweep of the industry, aiming to identify and prosecute any complicity or direct involvement in facilitating cyber extortion.

Following Van der Stap’s arrest, a figure known as "Rey," another member of ShinyHunters, assumed leadership of the group. Rey notably began taunting the FBI about the data the group had stolen from the agency’s online recruitment portal. This data reportedly included details about agents’ units and specializations, as well as their medical and psychiatric records, a particularly sensitive and damaging breach.

Just last week, Reuters reported that "Rey" has been identified as a teenager named Saif Al-din Khader and has been detained. He is reportedly cooperating with FBI investigators. Furthermore, on October 7th, KrebsOnSecurity detailed how Rey was apprehended after the cybercrime group allegedly attempted to extort a navigation and digital aviation unit that had been divested by Boeing in late 2025. This sequence of events suggests a rapid unraveling of the ShinyHunters operation, with key figures being brought to justice.

The FBI’s arrest of Edward Dubrovsky represents a significant development in the ongoing battle against sophisticated ransomware operations. It underscores the FBI’s commitment to dismantling not only the hacking groups themselves but also potentially the intermediaries who operate in the grey areas of cyber extortion negotiations. This story is developing rapidly, and further updates will be provided as more information becomes available.