Edward Dubrovsky built a career telling companies how to handle criminals who steal their data and demand payment. On Thursday, federal agents in Philadelphia arrested the 54-year-old Canadian cybersecurity executive and charged him with being one of those criminals himself.
Dubrovsky, the founder and former chief operating officer of the ransomware negotiation firm CYPFER, was taken into custody in the Philadelphia area, according to federal court documents first reported by Reuters and confirmed by KrebsOnSecurity, CyberScoop and Hackread. He is charged with conspiracy to threaten to impair the confidentiality of information with intent to extort money, along with interference with commerce through threats — better known as Hobbs Act extortion. Both appear in court records in the Eastern District of Pennsylvania, where the docket misspells his last name as "Dobrovsky."
The arrest comes as the FBI runs down the ShinyHunters hacking group, which drew national attention last month by stealing personal data tied to thousands of FBI employees and defacing the bureau's jobs website. FBI Director Kash Patel announced on X on Friday that agents had arrested another suspected co-conspirator of the group, writing: "This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly." Patel did not name the suspect — and authorities have not publicly confirmed whether that arrest was Dubrovsky's.
Multiple outlets, citing people familiar with the case, say it was. The New York Times reported that Dubrovsky was taken into custody on suspicion of being behind the breach that exposed sensitive data on FBI employees, and that federal authorities view him as a principal co-conspirator in ShinyHunters' attack on the bureau. CNN tied him to the FBI hack through multiple people familiar with the probe, and a law enforcement source told CBS News the same. None of that alleged connection is spelled out in the public filings, and the complaint filed in the Eastern District of Texas remains under seal. Dubrovsky has not been convicted or entered a plea, and Politico reported he could not be reached for comment.
According to the Globe and Mail, a magistrate judge in Philadelphia ordered him held and directed the U.S. Marshals Service to transport him to Texas for a detention hearing. The Bureau of Prisons' inmate locator lists him at the Federal Detention Center in Philadelphia with an unknown release date.
The court records reviewed by reporters do not detail how prosecutors allege Dubrovsky connects to ShinyHunters' operations — a gap worth stating plainly. But the charges themselves describe the mechanics of an extortion racket, not the work of a consultant helping victims. ShinyHunters has conducted dozens of data breaches since 2019, including the FBI database hack earlier this year.
There is a detail in the reporting that raises its own question about how investigators built the case. Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky — a thread that, if accurate, predates the ShinyHunters group itself. Reuters also noted that his LinkedIn profile describes a career built on negotiating with cybercriminals over ransom demands, and that a former employer credited him with helping thousands of clients recover from cyberattacks.
That is the uncomfortable position the ransomware negotiation industry now finds itself in. Firms hired to talk to extortion gangs operate in the same conversations, often the same cryptocurrency rails, as the criminals they claim to fight. For the first time in recent memory, a founder of one of those firms faces federal charges treating him as part of the crime rather than the mitigation.
The FBI declined to comment Sunday, referring reporters back to Patel's post. Whatever emerges in Texas, the bureau is signaling that the ShinyHunters case is not closing — and that the people who traffic in stolen data, whether they carry a criminal record or a company title, may end up on the same docket.
Our Take
Here is the part the legacy media will tiptoe around: the FBI just arrested a man whose entire professional identity was built on sitting across the table from hackers — and he is now accused of sitting on their side. If the bureau's case holds, Dubrovsky wasn't a middleman. He was the mole.
That matters for every American whose personal data sits in a government database. ShinyHunters didn't just hit some Fortune 500 server farm — they walked off with information on nearly every FBI employee and vandalized the bureau's own hiring site, then demanded the FBI retract a warning about them. The arrogance was off the charts. And if someone with the trust of breach victims was allegedly feeding the machine from the inside, that is exactly the kind of rot the FBI has spent years telling us only exists in Russia and China.
Patel deserves credit here. The arrests came in a matter of days, and the bureau is openly hunting additional leads. That's what it looks like when an agency stops playing defense and starts dismantling a network piece by piece.
But every business owner reading this should sit up straight. If you get hit with a ransomware demand tomorrow, ask hard questions about who you're paying to negotiate. The industry operates in a legal gray zone, and Thursday's arrest shows the gray is darker than the brochures admit. The people managing your breach may be closer to your attackers than anyone wants to believe — and in this case, the feds say the line didn't exist at all.
