FBI Arrests Canadian Cybersecurity Executive in ShinyHunters Hack Probe

The FBI has arrested a Canadian cybersecurity executive in connection with the ShinyHunters hack that exposed sensitive data of current and former FBI employees, according to court documents and people familiar with the investigation.

Edward Dubrovsky was taken into custody in the Philadelphia area in recent days, sources told Reuters and other outlets. FBI Director Kash Patel confirmed the arrest on Friday, calling the suspect a “suspected co-conspirator” in the ShinyHunters cyberattack on FBIjobs.gov, but did not name him. Patel said on social media: “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”

Dubrovsky faces two criminal charges in the U.S. District Court for the Eastern District of Pennsylvania: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats, according to court documents reported by Reuters and CBC News. The allegations have not been proven in court. The case has since been moved to the Eastern District of Texas, where the FBI’s ShinyHunters investigation is reportedly being run, SecurityWeek reported.

Court records provide conflicting spellings of the suspect’s last name — “Dobrovsky” or “Dobrosky” — and do not identify his age, profession or employer, CBC News reported. Prison records show a 54-year-old named Edward Dubrovsky is being held at a federal detention centre in Philadelphia. Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a 54-year-old resident of Richmond Hill, a suburb of Toronto.

Dubrovsky’s LinkedIn profile describes him as a “globally recognized cybersecurity expert” with years of experience in the Canadian cybersecurity industry, according to Slashdot and CBC News. He is the author of a book on handling ransomware negotiations with cybercriminals, titled “Cyber Extortion: Strategic Response,” SecurityWeek reported. He appears to be affiliated with Toronto-based CyberSteward, which offers ransomware negotiation services. The company posted photos of Dubrovsky at a conference in Philadelphia a week ago, where he was signing copies of his book, CBC News said.

The cybersecurity community expressed shock at the arrest. “For the cybersecurity community in general, I think that there's a sense of shock,” Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News. Kotak said Dubrovsky is “very popular” and has spoken at numerous conferences, but stressed that the charges “are clearly just allegations” and that it is not yet known “what exactly has happened.”

The breach that triggered the investigation stemmed from a contractor’s failure to update software, according to senior FBI cyber official Brett Leatherman, as reported by Slashdot. The software in question is a human-resources platform made by Oracle. ShinyHunters said the contractor had failed to apply a security patch that was available. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google’s Threat Intelligence Group, Slashdot reported. The FBI has “removed the contractor,” Leatherman said.

ShinyHunters is one of the world’s most prolific data theft and extortion groups, tied to major campaigns including breaches at Telus, Microsoft, Ticketmaster, and Canvas, according to CBC News and SecurityWeek. The group claimed responsibility for stealing a massive trove of data from the FBI, including officials’ job assignments, addresses, and social insurance numbers. The hackers said they carried out the attack in response to an FBI report warning organizations about ShinyHunters activity, SecurityWeek reported.

This is the third ShinyHunters suspect arrested in recent weeks. Authorities arrested one alleged key member in the Netherlands on September 15, and another in Jordan on September 28 who is cooperating with the FBI, SecurityWeek reported. The group’s Tor-based website no longer appears accessible at the time of writing, SecurityWeek noted.

The Royal Canadian Mounted Police confirmed it is aware of the arrest of a Canadian in the United States in connection with ShinyHunters, CBC News reported. The RCMP directed further questions to the FBI.