# FBI Arrests Ransomware Negotiator Linked to ShinyHunters

> FBI agents arrested a Canadian ransomware negotiation executive in Pennsylvania over alleged ties to the ShinyHunters hacking group.

- Published: 2026-10-13T15:28:07.000Z
- Severity: medium
- Category: Threat Intel
- Tags: ShinyHunters, Ransomware, Extortion, FBI, Cybercrime
- Author: Runtime Rebel Intel
- Primary source: https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
- Canonical: https://runtimerebel.com/blog/fbi-arrests-ransomware-negotiator-linked-to-shinyhunters

## Key points

- Federal law enforcement arrested a prominent cybersecurity executive on charges related to cyber extortion and the ShinyHunters hacking group.
- The investigation centers on ransomware negotiation practices and stolen corporate and agency data.
- Organizations should review incident response retainer relationships and ensure strict compliance and oversight during extortion events.

## Overview of the Arrest

Federal agents arrested an executive from a Canadian cybersecurity firm in Pennsylvania in connection with an ongoing investigation into the [ShinyHunters](https://en.wikipedia.org/wiki/ShinyHunters) cybercrime organization, according to reporting by [KrebsOnSecurity](https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/). The suspect, identified in federal court records as Edward Dubrovsky, faces cyber extortion and conspiracy charges. The arrest took place while the executive was attending a security conference in Philadelphia, with court documents subsequently initiating a case transfer to the Eastern District of Texas.

Federal court records filed in early October charge the defendant with conspiracy to threaten to impair the confidentiality of information with intent to extort money, alongside interference with commerce by threats. The investigation follows a series of high-profile data thefts attributed to ShinyHunters, which federal officials report has extorted more than $70 million from victims throughout the year.

## Technical Context and Campaign TTPs

[ShinyHunters](https://en.wikipedia.org/wiki/ShinyHunters) typically gains [initial access](/glossary#initial-access) by deploying targeted [phishing](/glossary#phishing) campaigns and leveraging stolen credentials to compromise corporate accounts on software-as-a-service platforms. Once inside target environments, the group extracts sensitive data and threatens publication unless substantial ransom demands are fulfilled. 

Recent escalation followed law enforcement actions in Europe and North America. Earlier operations by Dutch police resulted in the arrest of individual Pepijn van der Stap, after which an actor known as "Rey" assumed operational control of the hacking group. "Rey" subsequently taunted investigators regarding data stolen from federal recruitment portals, including personnel and medical records, before international law enforcement detained a teenager linked to the online persona.

### Implications for Incident Response and [Ransomware](/glossary#ransomware) Negotiation

The intersection of third-party advisory firms and criminal extortion syndicates remains a focal point for investigators. Industry standards dictate strict demarcation between incident response advisory, communication, and illicit payment facilitation. Investigators are examining whether certain advisory operations crossed legal boundaries into conspiracy or facilitating extortion payouts to criminal enterprises.

## Defensive Recommendations

Security and compliance leaders should evaluate third-party risk management procedures, particularly concerning incident response and negotiation retainers:

* **Vendor Vetting:** Conduct rigorous background and compliance checks on external incident response and negotiation providers to ensure strict adherence to legal frameworks and sanctions compliance.
* **Identity and Access Management:** Harden SaaS environments against [credential theft](/glossary#credential-theft) by enforcing phishing-resistant multi-factor authentication and continuous session monitoring.
* **Legal Consultation:** Establish clear protocols involving legal counsel before initiating any dialogue or engagement with known extortion syndicates.

**Related:** [ShinyHunters Breaches Brinks Home, Threatens Data Leak](/blog/shinyhunters-breaches-brinks-home-threatens-data-leak), [Qilin Ransomware Suspect Extradited, Group Exploits Check Point VPN](/blog/qilin-ransomware-suspect-extradited-group-exploits-check-point-vpn)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/fbi-arrests-ransomware-negotiator-linked-to-shinyhunters