FBI arrests Canadian cyber executive in ShinyHunters extortion case

Federal authorities arrested a Canadian cybersecurity executive this week on extortion conspiracy charges, the latest step in the FBI's investigation into the ShinyHunters hacking group's breach of the bureau's jobs portal.

Edward Dubrovsky, 54, a former chief operating officer and founder of CYPFER — a firm that helps organizations negotiate with ransomware operators — was arrested Thursday in Pennsylvania, according to federal court records cited by CyberScoop. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed.

Dubrovsky's LinkedIn page lists his role at CYPFER and an affiliation with CyberSteward, described on LinkedIn as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month he released a book on handling ransomware negotiations. Neither Dubrovsky nor CYPFER responded to requests for comment, CyberScoop reported.

The case appears to align with actions taken in the wake of the ShinyHunters attack on the FBI's IT systems, which exposed personal data about thousands of bureau employees, according to CyberScoop. The FBI did not publicly announce the arrest, but FBI Director Kash Patel said in a social media post that agents had arrested "another suspected co-conspirator" of the group without naming the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

Politico reported that it is not yet clear whether Dubrovsky's arrest is related to the massive recent breach affecting the FBI.

The breach

The ShinyHunters group said it stole information belonging to nearly all FBI agents and people who applied to work for the bureau, according to a Reuters report cited by Fox News. A sample of data shared with the outlet contained agents' names, home addresses, Social Security numbers, assignments and, in some cases, names of family members. The extent of the breach has not been independently confirmed.

In an Oct. 9 statement, Patel said the arrested individual was another suspected co-conspirator of ShinyHunters, "the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor." He added: "This arrest demonstrates the strength and reach of our efforts to protect Americans from cybercrime. We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate."

Brett Leatherman, the FBI's assistant director for cyber, said a review found the breach resulted from a third-party platform where a contractor had not installed a security patch issued for the system, according to CyberScoop. Reuters reported that the contractor worked for Accenture.

The attack marks a notable escalation by ShinyHunters, a group that has previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers, CyberScoop noted. Previous victims this year include Instructure, Salesforce, Snowflake and McKesson.

Related arrests

Several suspects have been taken into custody since the breach was disclosed. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters, and a teenager identified by Reuters as Saif Al-din Khader was detained and is cooperating with investigators, CyberScoop reported.

A Reuters report detailed the account of Adem El Adeb, 19, a friend of Khader who goes by the old hacker alias Pryx. El Adeb told Reuters he repeatedly urged Khader not to break into the FBI, recalling a message exchange in early September: "You're suicidal." El Adeb said he told the teen he was "crazy" and should drop the idea. "Not only once. Multiple times. I tried to advise him."

Khader, whom El Adeb says is 17, was taken into custody in Jordan on Sept. 29 and is cooperating with the bureau's investigation, people familiar with the matter told Reuters. Khader's alleged hacker nickname was Rey. El Adeb and Khader were publicly known members of the cybercrime group Hellcat, which emerged in 2024 and took responsibility for several attention-grabbing hacks, including a break-in at France's Schneider Electric in which the hackers demanded $125,000 worth of baguettes as ransom.

Reuters also reported that Pepijn van der Stap, another suspected ShinyHunters hacker, was arrested by Dutch police on Sept. 15 and is being investigated over allegations that he tried to organize murders abroad.

Dubrovsky's case has been moved to the Eastern District of Texas, where he will be detained until a detention hearing is scheduled, according to his case docket cited by CyberScoop.