Cybercrime
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.
By
|
October 12, 2026 (6:32 AM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/) [+ Whatsapp](whatsapp://send?text=Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/) + Email
A Canada-based cybersecurity expert was arrested last week in the United States on suspicion of being involved in ShinyHunters attacks, including the recent hacking of FBI systems.
FBI director Kash Patel announced on Friday that agents had arrested another suspected ShinyHunters co-conspirator.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” Patel stated , adding, “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
The suspect has not officially been named, but The New York Times and cybersecurity blogger Brian Krebs reported that he is Edward Dubrovsky, a Canadian cybersecurity expert specializing in ransomware response.
The Royal Canadian Mounted Police confirmed for CBS News that it’s aware of the arrest of a Canadian in the United States in connection with ShinyHunters.
Dubrovsky was reportedly arrested by the FBI after traveling to Philadelphia for a conference. He is suspected of being involved in the recent ShinyHunters attack targeting the FBI.
Advertisement. Scroll to continue reading.
The extortion group claimed to have accessed the FBI’s jobs website and other systems, allegedly obtaining information on nearly all agents and job applicants. The hackers said they carried out the attack in response to a report the FBI published earlier in the year warning organizations about ShinyHunters activity.
The FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software.
Dubrovsky appears to be affiliated with Toronto-based CyberSteward, which offers ransomware negotiation services. His LinkedIn profile lists him as an executive at a couple of North American cybersecurity companies in recent years. Dubrovsky is also the author of a book titled “Cyber Extortion: Strategic Response”.
Court records (which spell his name Dobrovsky) show the man was charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats.
Records also show the case has since been moved to the Eastern District of Texas, where the FBI’s ShinyHunters probe is reportedly being run.
This is the third ShinyHunters suspect arrested in recent weeks. Authorities arrested one alleged key member in the Netherlands on September 15. Another alleged key member was reportedly arrested in Jordan on September 28 and is cooperating with the FBI.
In late September, ShinyHunters appeared defiant, saying that its operations and infrastructure had remained unaffected and urging victims to pay up. Statements addressed to the FBI and victims were later removed from the group’s Tor-based website, and the site no longer appears to be accessible at the time of writing.
Sources told Krebs that executives at other firms offering ransomware negotiation services could face charges in this case.
Related : Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Related : US Disrupts Chinese State-Sponsored Hacking Tools
Related : Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Written By
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
- Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
- Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
- Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
- US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
- TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
- Oracle Health Data Breach Tally Climbs to Nearly 20 Million
- Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
- Advantest Discloses Data Breach Months After Ransomware Attack
Latest News
- IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
- Canonical Websites Disrupted in Second DDoS Attack This Year
- Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
- iRhythm Data Breach Impacts at Least 360,000 People
- Critical SonicWall Vulnerability Exploited Days After Disclosure
- Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
- Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Trending
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Critical SonicWall Vulnerability Exploited Days After Disclosure
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
iRhythm Data Breach Impacts at Least 360,000 People
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Security Awareness Training Isn’t Dead, but It Needs a Rethink
Canonical Websites Disrupted in Second DDoS Attack This Year
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?
October 14, 2026
Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Rapid7 has named Rik Ferguson as VP of Security Intelligence.
Cytactic has appointed Tim Brown as CSO.
Scott Simkin has joined Vega as CMO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/) [+ Whatsapp](whatsapp://send?text=Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.