FBI Arrests Canadian Cybersecurity Executive in ShinyHunters Data Breach Probe

The FBI has arrested a Canadian cybersecurity executive as part of its investigation into a damaging data breach that compromised the personal information of current and former FBI employees, according to court documents and people familiar with the matter.

Edward Dubrovsky, 54, was taken into custody in the Philadelphia area in recent days and faces charges related to extortion and making threats, multiple sources reported. He has been transferred to the Eastern District of Texas for a scheduled detention hearing, according to court records and a law enforcement official.

FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or the suspect’s role in the hack, and did not name Dubrovsky. Patel said in a statement that “our agents in the field arrested another suspected co-conspirator of the ShinyHunters group, the group believed to be responsible for the recent FBIJobs.gov incident, which occurred on a platform managed by a third-party vendor.”

**Charges and Background**

Dubrovsky is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money, according to federal court records posted Friday and reported by CyberScoop. Other details of the case remain sealed.

A LinkedIn profile under Dubrovsky’s name lists years of experience in the Canadian cybersecurity industry and describes him as a “globally recognized cybersecurity expert.” He is a former chief operating officer and founder of CYPFER, a firm that helps organizations negotiate with ransomware operators. An Ed Dubrovsky is also the author of a book on handling ransomware negotiations with cybercriminals, according to multiple sources.

Neither Dubrovsky nor CYPFER responded to requests for comment, CyberScoop reported.

**Breach Root Cause: Unpatched Oracle Platform**

The FBI determined that a contractor managing the bureau’s jobs portal failed to update software “explicitly issued to secure the platform,” senior FBI cyber official Brett Leatherman said last week. The FBI has “removed the contractor,” he said.

The software in question is a human-resources platform made by Oracle, according to ShinyHunters. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google’s Threat Intelligence Group. Months later, the FBI contractor apparently still had not applied a security patch that was available for the software, multiple sources reported.

Reuters reported that the contractor worked for Accenture, according to CyberScoop.

**Scope of the Breach**

The ShinyHunters group claimed it stole information belonging to nearly all FBI agents and people who applied to work for the bureau, Reuters previously reported. A sample of data shared with the outlet contained agents’ names, home addresses, Social Security numbers, assignments and, in some cases, names of family members. The FBI has told staffers it is operating under the assumption the stolen data pertains to all its employees, a person briefed on the matter told Reuters last month.

The extent of the alleged breach has not been independently confirmed.

**Additional Arrests and Investigation**

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. That suspect, identified by Reuters as Pepijn van der Stap, is being investigated over allegations that he tried to organize murders abroad, according to a Reuters report cited in Dark Reading sources.

Additionally, a teenager identified by Reuters as Saif al-Din Khader was detained in Jordan on September 29 and is cooperating with the bureau’s investigation, people familiar with the matter told Reuters. Khader, whom a former associate says is 17, is alleged to have played a key role in the hack.

**Friend’s Account of Warning Teen**

Adem El Adeb, 19, a former associate of Khader who goes by the hacker alias Pryx, told Reuters that he tried to convince Khader last month that breaking into the FBI would bring the weight of the U.S. government down on his shoulders. “You’re suicidal,” El Adeb recalled telling Khader in an early September message exchange. He said he told the teen he was “crazy” and that he should drop the idea. “Not only once. Multiple times. I tried to advise him.”

Reuters reported that El Adeb said he and Khader met online when they were 11 or 12 and experimenting with hacking, bonding over their shared support for the Palestinian cause. El Adeb said he quit cybercrime before turning 18 and is now setting up a cybersecurity business called VulOne. “I’m clean now,” he said.

Reuters could not fully corroborate El Adeb’s account of his past or his exchanges with Khader.

**Ongoing Enforcement**

Patel said the FBI is working with its partners to dismantle the ShinyHunters group and its associates. “This arrest demonstrates the strength and reach of our efforts to protect Americans from cybercrime. We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate,” he said in a statement reported by Fox News.

The case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled, according to court records.