Net Closes Around ShinyHunters with Another FBI Arrest
FBI arrested Canadian executive Edward Dubrovsky, alleging he conspired with ShinyHunters after the FBIjobs.gov breach.
FBI Director Kash Patel said on October 9 that agents arrested another suspected ShinyHunters co-conspirator tied to the September 2026 FBIjobs.gov breach. Court documents identify Edward Dubrovsky, 54, a Toronto cyber executive formerly at Cypfer and linked to CyberSteward, charged with conspiracy to extort and interference with commerce by threats. The group allegedly exploited an Oracle PeopleSoft vulnerability, pivoted into AWS GovCloud, and took 2-3TB that may include names, SSNs, and emergency contacts for thousands of FBI employees, including counterintelligence staff. Dutch police had arrested Pepijn van der Stap, Jordan detained 17-year-old Saif Al-din Khader on September 29, and an Accenture contractor was removed for failing to patch the flaw.
- FBI arrested Toronto executive Edward Dubrovsky as a suspected ShinyHunters co-conspirator.
- Charges include extortion conspiracy and interference with commerce by threats.
- Attackers exploited Oracle PeopleSoft, then stole 2-3TB from AWS GovCloud.
- Exposed data reportedly includes SSNs for thousands of FBI employees.
- Dutch and Jordanian arrests preceded this; an Accenture contractor was removed.
Full article421 words · extracted from infosecurity-magazine.com · click to collapse
The FBI has arrested a Canadian cybersecurity executive on suspicion of involvement with the ShinyHunters group, which was responsible for a major breach at the bureau last month.
FBI director, Kash Patel, confirmed the arrest on X October 9, without naming the individual in custody.
“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” he said on X (formerly Twitter).
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly.”
Read more on ShinyHunters: ShinyHunters Claim Hack of Rival Ransomware Gang Clop.
However, court documents indicate the identity of the person arrested as Edward Dubrovsky, a cyber founder and investor based in Toronto.
He has been charged with conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference with commerce by threats.
Dubrovsky, 54, is reportedly a former managing director at incident response firm Cypfer and currently associated with cyber-consulting firm CyberSteward.
He appears to be a self-styled expert in negotiating with cyber extortionists, as evidenced by a book he authored, Cyber Extortion Strategic Response. The book is marketed as a “practical manual for leaders on managing coercive events, negotiation and settlement strategies.”
Arrests Mounting for ShinyHunters
Dubrovsky is the latest of a number of recent arrests as the FBI seeks to hit back at the group responsible for a serious data breach in September 2026.
Dutch police arrested convicted cybercriminal Pepijn van der Stap in connection with the incident.
Saif Al-din Khader (aka Rey), who is 17, was taken into custody in Jordan on September 29 and is said to be cooperating with the FBI’s investigation.
That came after ShinyHunters exploited a vulnerability in Oracle PeopleSoft to compromise the agency's jobs site, and then pivoted to its AWS GovCloud servers to extract 2-3TB of data.
Experts believe it could be one of the most damaging government breaches in recent history, if reports are correct that the hackers made off with names, addresses, telephone numbers, dates of birth, social security numbers, and emergency contact details for thousands of FBI employees, including those in counter-intelligence work.
It has been reported that an Accenture contractor has been removed from their work with the bureau after failing to patch the vulnerability which was subsequently exploited by ShinyHunters.