- Published on
FBI Arrests Executive at Ransomware Negotiation Firm
- Authors
- Name
- DeepHorus
Federal agents arrested a Canadian cybersecurity executive in Pennsylvania on Thursday as part of an investigation into the ShinyHunters hacking group, which recently stole sensitive data on thousands of FBI agents. The New York Times first reported that a Canadian man was arrested in Pennsylvania on suspicion of assisting ShinyHunters. FBI Director Kash Patel confirmed the arrest on Twitter/X but did not name the suspect. Sources told KrebsOnSecurity that the man was visiting Pennsylvania for a cyber insurance conference.
The suspect's company specialized in handling ransomware negotiations with cybercrime groups, one source said. Another source said control over the ShinyHunters investigation has been centralized at an FBI field office in Texas. The Cyber Risk Summit took place at the Loews Philadelphia Hotel from Oct. 5 to Oct. 7. Its largest sponsor was Cypfer, a Canadian security company, according to the summit's website.
LinkedIn records identify Edward Dubrovsky as one of Cypfer's "ex-founders." He is now associated with CyberSteward, another Canadian security firm and summit sponsor. In a LinkedIn post about a month ago, Dubrovsky said he planned to attend the Cyber Risk Summit with the CyberSteward team. "Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic," he wrote.
A Cypfer spokesperson later said Dubrovsky was not a founder or co-founder, despite his LinkedIn profile, but served as a managing director before resigning in November 2025. Federal court records show that on Oct. 8, an Edward Dobrovsky—with a slight misspelling—was arrested in Pennsylvania on cyber extortion and conspiracy charges. Several documents, including the core complaint, are sealed, but CourtListener.com indexed a complaint summary. The charges include "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats."
The U.S. Bureau of Prisons inmate locator reports that a 54-year-old Edward Dubrovsky is being held at a federal facility in Philadelphia. Court records indexed by CourtListener include an Oct. 9 notice moving the case to the Eastern District of Texas, which sources describe as the center of the FBI's ShinyHunters investigation. The FBI declined to comment.
Dubrovsky's LinkedIn profile states he authored Cyber Extortion Strategic Response, a 252-page book that promises to "take readers beyond the ransom note and into the decisions that determine how an organization responds, recovers, and protects what matters." An excerpt says: "At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay." It adds that engagement can test claims, gather information, create time, and preserve options.
Dubrovsky could not be immediately reached for comment. KrebsOnSecurity also sought comment from other CyberSteward executives. Court records show Dubrovsky does not currently have an attorney and has not yet been appointed a public defender. ShinyHunters typically uses phishing and stolen credentials to siphon data from corporations, according to the source material.
