- What: KrebsOnSecurity reports the FBI arrested an executive at a Canadian ransomware negotiation firm in Pennsylvania on October 8 on cyber extortion and conspiracy charges tied to its ShinyHunters investigation.
- Impact: Sources say charges against principals at other ransomware negotiation firms may follow, which puts the trusted intermediary in an extortion response under suspicion.
- Fix / mitigation: There is no patch for this one: the mitigation is governance, meaning independent oversight of whoever speaks to the extortionist on your behalf.
- Who's at risk: Any organization, insurer or law firm that relies on an outside negotiator during an extortion event, especially victims of ShinyHunters.
When an extortion crew is holding your data, the negotiator is the one outsider you let all the way in. They learn what was stolen, what the board will pay, what the insurance policy covers and how much time you have. On Thursday, October 8, the FBI arrested a man who built a career in that seat.
According to KrebsOnSecurity, agents arrested an executive at a Canadian cybersecurity firm in Pennsylvania in connection with the bureau's investigation into ShinyHunters, the group that recently took sensitive data on thousands of FBI agents. The New York Times reported the arrest of a Canadian man on suspicion of assisting ShinyHunters but did not name him. Neither did a statement from FBI Director Kash Patel.
What the public record shows
Krebs assembled the identification from open sources. One source close to the investigation said the suspect was visiting Pennsylvania for a cyber insurance conference and that his company specialized in ransomware negotiations with cybercrime groups. The Cyber Risk Summit ran at the Loews Philadelphia Hotel from Oct. 5 to Oct. 7. Its biggest sponsor was the Canadian firm Cypfer, and another Canadian firm, CyberSteward, was also a sponsor.
Edward Dubrovsky's LinkedIn profile lists him as an "ex-founder" of Cypfer and associates him with CyberSteward. About a month ago he posted that he planned to attend the summit with the CyberSteward team. A Cypfer spokesperson told Krebs that Dubrovsky was not a founder or co-founder, and instead served as a managing director before resigning in November 2025.
Federal court records show an Edward Dobrovsky, with a slightly different spelling, was arrested in Pennsylvania on October 8. The core complaint is sealed, but a summary indexed by CourtListener lists two charges: "conspiracy to threaten to impair the confidentiality of information with the intent to extort money," and "interference with commerce by threats." The Bureau of Prisons inmate locator shows a 54-year-old Edward Dubrovsky held at a federal facility in Philadelphia. A notice filed October 9 moved the case to the Eastern District of Texas, which sources describe as the center of the FBI's ShinyHunters investigation.
The complaint is sealed and nothing has been proven. Krebs reports that Dubrovsky could not be reached for comment, that court records show he has no attorney yet, and that the FBI declined to comment. CyberSteward executives had not responded at the time of publication. Cypfer disputes the founder title on his LinkedIn profile.
Why this lands so hard
Dubrovsky's LinkedIn profile says he is the author of Cyber Extortion Strategic Response, a 252-page book on how organizations should handle extortion. Its Amazon listing draws a careful line: "communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay." Engagement, the excerpt says, can serve to test claims, gather information, create time and preserve options.
That is the standard pitch of the negotiation industry, and it is a reasonable one. It is also a description of a role with enormous information advantage and very little oversight. The charges in the summary describe conduct on the other side of the table: conspiring to threaten the confidentiality of information to extort money.
The wider investigation
ShinyHunters typically uses phishing and stolen credentials to pull data from corporate accounts at software-as-a-service companies, then threatens to publish unless a ransom is paid. The FBI says the group has extorted more than $70 million from victims so far this year.
The investigation has moved quickly. Dutch police arrested convicted cybercriminal Pepijn van der Stap last month, and sources told Krebs the FBI has been going through the devices seized in that arrest. A member known as "Rey" then took control of the group and taunted the FBI over data stolen from the agency's online recruitment portal, which included each person's unit and specialization as well as medical and psychiatric records. Reuters reported last week that Rey, identified as a teenager named Saif Al-din Khader, had been detained and was cooperating. Krebs reported on October 7 that Rey was apprehended as the group allegedly tried to extort a navigation and digital aviation unit divested by Boeing in late 2025.
Sources told KrebsOnSecurity that charges against principals at other companies that specialize in ransomware negotiation may be forthcoming. If that holds, this is an industry problem, and not the story of one individual.
The RedEye take
The security industry treats the negotiator as a neutral utility, like a locksmith. That was always a convenient fiction. A negotiator's business depends on repeat contact with the same criminal groups, and their value to a client is measured in outcomes nobody else can verify. The victim rarely sees the raw conversation in real time, rarely knows what the criminals were told about its finances, and has no way to check whether the "discount" was real.
We do not know what the sealed complaint alleges in detail, and we will not guess. But the structural problem does not depend on the outcome of this case. An intermediary who knows both the victim's ceiling and the attacker's floor holds the most valuable information in the transaction. An industry that operates on reputation, referrals from insurers and almost no independent audit should expect this kind of scrutiny, and it has arrived.
Insider threat programs are built around employees and contractors with network access. This story is a reminder that the most dangerous insider in an extortion event may be the one with no credentials at all, only the full picture.
What defenders should learn
- The negotiator is a privileged insider for the duration of an incident. They hold the payment ceiling, the insurance limits and the breach scope, and that access deserves the same due diligence and contractual controls applied to any vendor with sensitive data.
- Titles and bios in this market are self-reported. Cypfer's correction of a LinkedIn founder claim shows how thin public credentials can be, so vetting should rest on verified references and corporate records, not profiles and conference stages.
- Selection through an insurance panel is not vetting. The suspect was reportedly arrested while visiting a cyber insurance conference, the same channel through which many victims are handed a negotiator they never chose.
- Visibility into the conversation is a control, not a courtesy. A victim that cannot see the full, unedited communications with the extortionist, and that has no second party reviewing them, cannot detect an intermediary working against it.
- Past engagements may warrant a second look. With sources saying charges at other negotiation firms may follow, organizations that paid or negotiated with ShinyHunters this year should ask counsel what was shared with their intermediary and how the settlement figure was reached.
Krebs notes this is a fast-moving story and that updates will be timestamped. Source: KrebsOnSecurity, "FBI Arrests Executive at Ransomware Negotiation Firm," October 9, 2026, https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us