The FBI arrested Edward Dubrovsky in Pennsylvania on October 8, 2026, on cyber extortion and conspiracy charges tied to its investigation of the ShinyHunters data extortion group. Dubrovsky co-founded the Canadian security firm Cypfer and is now associated with CyberSteward, another Canadian firm. Both businesses work the ransomware negotiation side of incident response, the people a victim organization calls to talk to the criminals holding its data. This analysis draws on reporting from Krebs on Security.

He was in Philadelphia for the Cyber Risk Summit, a cyber insurance conference held at the Loews Philadelphia Hotel from October 5 to 7, where Cypfer was listed as the largest sponsor. A LinkedIn post from roughly a month earlier said he planned to attend with the CyberSteward team to discuss "coercive (ransomware, extortion) advisory, negotiations and settlement services."

The charging summary indexed at CourtListener lists "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." The core complaint is sealed. On October 9 the case moved to the Eastern District of Texas, which sources describe as the center of the ShinyHunters investigation. Dubrovsky, 54, is held at a federal facility in Philadelphia and has not yet been appointed counsel. These are allegations, and nothing has been adjudicated.

The investigative thread runs through two earlier arrests. Dutch police arrested convicted cybercriminal Pepijn van der Stap last month, and the FBI has been examining the devices seized in that operation. A ShinyHunters member using the handle "Rey," identified by Reuters as a teenager named Saif Al-din Khader, has been detained and is cooperating.

According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

If your firm has retained an outside negotiator, the relevant point is that sources tell KrebsOnSecurity charges against principals at other ransomware negotiation companies may be forthcoming.

How a Negotiation Firm Becomes an Extortion Channel

The complaint summary in the case charges two offenses that say a great deal about the alleged role: "conspiracy to threaten to impair the confidentiality of information with the intent to extort money," and "interference with commerce by threats." Neither charge describes breaking into a network. Both describe what happens after the data is already gone.

That distinction matters because ShinyHunters does not encrypt anything. The group phishes employees and reuses stolen credentials to log into corporate accounts at software-as-a-service providers, pulls the data out through the application's own interfaces, and then threatens publication unless it is paid. In MITRE ATT&CK terms that is phishing (T1566) and valid accounts (T1078) feeding exfiltration over a web service (T1567), with no malware stage that an endpoint agent would flag.

When the intrusion itself is that quiet, the money is made entirely in the conversation afterward. Pricing an extortion demand is a guessing game for the attacker, who has to infer from sampled records how much a company can pay, how badly the disclosure would hurt, and how long the board will hold out.

A negotiation firm sits on the other side of that guess with the answers written down. By the time a responder is engaged, they typically know the confirmed scope of exfiltration, which record types are involved, the regulatory notification exposure, the cyber insurance tower and its retention, and the internal number above which the organization will refuse to pay. That package is the victim's own valuation of the incident, and it is the single most useful document an extortion crew could obtain.

Negotiators also serve as the verification layer. As the defendant's own book on cyber extortion puts it, engagement exists to test claims, gather information, create time, and preserve options while the organization decides what to do. Someone positioned there can tell a crew whether a bluff about stolen data held up, which proof samples moved the victim, and when the company is close to authorizing payment.

The structural problem is access, not technique. Incident response work gives a firm log collection, cloud administrative consoles, email review, and endpoint telemetry across the victim environment during containment, often under terms that keep the work product tightly held. If your organization retains a negotiation specialist, that firm's visibility into the breach usually exceeds that of most of your own staff.

Investigators appear to be treating this as a pattern rather than a one-off. Sources told KrebsOnSecurity that the FBI has been examining devices seized when Dutch police arrested Pepijn van der Stap, and that charges against principals at other firms specializing in ransomware negotiation may follow. Seized phones and laptops are where contact between a crew and anyone advising it would be preserved, including chat logs, payment discussions, and timing.

The group's recent targeting shows what the data is worth once taken. ShinyHunters stole records from the FBI's online recruitment portal that included each applicant's unit and specialization along with medical and psychiatric records, and after van der Stap's arrest a member known as Rey, identified by Reuters as teenager Saif Al-din Khader, took over and used that theft to taunt the agency publicly. The same crew allegedly tried to extort a navigation and digital aviation unit that Boeing divested in late 2025.

Federal prosecutors moved the case to the Eastern District of Texas on October 9, the venue now handling the broader ShinyHunters investigation. The allegations remain unproven, and court records indicate the defendant has not yet been assigned counsel.

Business Risk for Organizations That Used Third-Party Negotiators

The FBI is working through devices seized last month when Dutch police arrested Pepijn van der Stap, and sources tell KrebsOnSecurity that charges against principals at other companies specializing in ransomware negotiation may be coming. If your organization paid an extortion demand in the past few years, the firm that handled those conversations may become a subject of federal interest, and the engagement file it built on your incident travels with it.

That file is usually the most sensitive record of the entire event. Depending on the vendor, it can include:

• The complete negotiation transcript, including what the criminals claimed to hold and what your side conceded under pressure.
• The final payment figure, the wallet addresses used, and the internal approval chain that authorized it.
• Your cyber insurance policy limits, sublimits, and the carrier correspondence approving the spend.
• Forensic detail on exactly which records were taken, often more granular than anything you disclosed to regulators or customers.
• Candid internal assessments of the control failures that let the intrusion happen.

You created that material on the assumption that three parties would ever read it: your counsel, your carrier, and you. A federal investigation into the intermediary changes that assumption without your participation.

The immediate commercial risk is re-extortion. A criminal group that learns what you paid, how fast you paid, and where your coverage tops out holds a pricing sheet for the next approach, and your negotiating position in any future incident starts from a worse place.

Insurance is the second pressure point. Carriers that placed a now-scrutinized vendor on their incident response panel have reason to revisit how those claims were handled, which can surface disputes over whether the payment was reasonable and whether the vendor's representations supported the claim. Expect underwriters to ask, at renewal, who ran your negotiations and what documentation you retained.

Sanctions exposure sits with you rather than the intermediary. Payment screening against restricted-party lists is typically performed by the negotiation or settlement firm, and your record of having done proper diligence is only as good as the firm that produced it. If that documentation becomes unreliable, your position weakens on a payment that may have reached a designated person or entity.

Disclosure obligations follow from the same problem. Many organizations settled quietly on the understanding that the incident would never be attributed publicly, and court filings, unsealed exhibits, and press reporting can put your name into the record years later. Regulators and plaintiffs' counsel reading those filings may conclude that the description you filed at the time was incomplete.

Privilege deserves its own line in your risk register. Negotiation vendors are routinely retained through outside counsel so their work product stays protected, and allegations that a vendor participated in a conspiracy give opposing parties an argument for piercing that protection in civil litigation.

The wider effect lands on the response supply chain your incident plan depends on. Breach counsel, forensics firms, settlement facilitators, and the carriers who approve them operate on the premise that the people hired to talk to criminals are not working with them, and that premise is now being tested in federal court. The core complaint in the case is sealed, so you may not learn whether your matter is referenced until a later filing makes it public.

Vetting and Controlling Incident Response and Negotiation Partners

Start by pulling a list of every extortion or data-theft incident your organization handled in the last five years, and note who ran the communications with the attackers on your behalf. That list is the scope of your exposure here. If the negotiation work was subcontracted by your breach counsel, your incident response retainer firm, or your insurer's panel, the contracting party may not be the party that actually sat in the chat window, so ask for the names of the individuals involved.

Put a legal hold on everything connected to those engagements before anyone starts tidying up. That includes the vendor's reports, invoices, wallet addresses used for any payment, chat exports, and your own internal email about the decision to engage. Federal interest in a vendor turns your file into potential evidence, and a deletion that happens after the news breaks looks very different from one that happened under a routine retention schedule.

Tell your cyber insurer and your outside counsel in the same week, not after a subpoena arrives. Counsel needs to assess whether privilege over the engagement still holds if a third party in the chain is charged, and your carrier needs to know because coverage decisions on the original claim may be revisited. Both conversations go better when you raise them first.

Then re-examine the incidents themselves for signs that the access was reused. Credentials, API tokens, and OAuth grants exposed during an earlier breach often remain valid long after the incident is declared closed, and a rotation done under pressure during a live event is rarely complete. In environments Capstone manages, Adlumin flags authentication anomalies such as logins from new geographies against accounts that were part of a prior incident, which is how reuse of old credentials surfaces before it becomes a second extortion event.

For future engagements, fix the contract terms before you need them:

• Named-personnel clauses that list who may work your matter, with written notice required before substitution or subcontracting.
• Background and sanctions screening obligations for anyone touching the engagement, with attestation on renewal rather than at onboarding only.
• Data handling and retention limits: what the firm may copy, where it may store it, and a defined destruction date with certification.
• Audit rights that let you or your insurer inspect the firm's handling of your matter, including its own security controls.
• Immediate notification if the firm, its principals, or its staff become subject to a criminal or regulatory investigation.

Control the access as tightly as the contract. External responders should get scoped, time-limited accounts with their own identities, never shared admin credentials, and every action they take should land in logs you own and retain. Run negotiation communications on a channel separate from your production email and collaboration tools, so the people advising you on the extortion are not operating inside the environment under investigation.

For the longer horizon, work with your insurer to pre-vet the panel firms you would actually call, and ask each one how it screens counterparties against sanctions lists before any payment moves. Then run a tabletop with an uncomfortable premise: your negotiation partner is compromised or conflicted midway through an incident. The exercise should establish who makes the call to disengage, who takes over communications, and how you preserve the record of what was already said.

What Security Leaders Should Take From This Case

The case against Edward Dubrovsky is unproven. The core complaint is sealed, court records show he had no attorney and no appointed public defender as of this week, and charges are allegations until tested. The takeaway for you is about vendor trust models, not about one defendant's guilt.

Your security program probably treats the negotiation firm as part of the response rather than as a supplier with access. That category error is the gap. The people who read your stolen file listing, see your payment authority, and speak to the attacker on your behalf hold a position in your incident that no other vendor holds, and in most organizations they are engaged under emergency conditions with minimal diligence.

Treat them the way you treat any privileged third party. That means named individuals in the contract, defined handling and retention terms for the engagement record, and the same access review you would apply to a provider with administrative rights. Your historical engagements deserve the same look, because the record of a 2023 negotiation still exists somewhere and still describes your environment.

Watch where this case goes procedurally. The matter moved to the Eastern District of Texas on October 9, consolidating with the broader ShinyHunters work, and Saif Al-din Khader is reported to be cooperating with investigators after his detention. Cooperating defendants produce evidence about counterparties, and the counterparties in extortion cases include the firms that handled victim-side communications.

If you have paid an extortion demand, know who holds that file and under what terms.