FBI Arrests Canadian Cybersecurity Executive in ShinyHunters-Linked Cybercrime Investigation

Federal Bureau of Investigation (FBI) agents arrested Canadian cybersecurity executive Edward Dubrovsky in Pennsylvania on October 8, 2026.

This arrest is part of an investigation into alleged assistance to the ShinyHunters cybercrime group, according to KrebsOnSecurity.

The case involves accusations of cyber extortion and conspiracy; however, the complaint remains largely sealed, so the specific allegations against Dubrovsky are undisclosed.

FBI Arrests Cybersecurity Executive

Court records list the defendant as Edward Dobrovsky, which differs from the spelling of Dubrovsky found in his professional profiles.

KrebsOnSecurity noted that the Bureau of Prisons has identified a 54-year-old Edward Dubrovsky in federal custody in Philadelphia.

The reported summary of the complaint alleges “conspiracy to threaten to impair the confidentiality of information with the intent to extort money” and “interference with commerce by threats.” These are allegations, not findings of guilt.

An October 9 court order committed Dubrovsky to the Eastern District of Texas, where an FBI field office is reportedly coordinating the wider ShinyHunters investigation.

Contrary to earlier reports, the Pennsylvania docket indicates that Federal Defenders have been appointed to represent him. He remains detained pending a hearing in the charging district.

Dubrovsky is affiliated with the Canadian cybersecurity firm CyberSteward and previously worked at Cypfer. In a clarification on October 10, Cypfer said he served as a managing director and was not a founder or co-founder; he resigned in November 2025.

Sources informed KrebsOnSecurity that Dubrovsky was in Pennsylvania to attend a cyber insurance conference, the Cyber Risk Summit, which took place from October 5 to 7 at the Loews Hotel in Philadelphia. He had publicly announced his plans to attend with colleagues from CyberSteward.

Professionally, Dubrovsky has experience in ransomware negotiation and extortion response. He authored “Cyber Extortion Strategic Response,” which distinguishes between communication with criminals and payment-related negotiations.

ShinyHunters typically uses phishing and stolen credentials to infiltrate corporate software-as-a-service accounts, extract sensitive information, and demand payment under threat of public disclosure. According to KrebsOnSecurity, this attack model focuses on compromising identities and weaponizing stolen data rather than encrypting systems.

The report says the FBI attributes over $70 million in extortion proceeds to ShinyHunters during 2026. Investigators are also analyzing devices seized after Dutch authorities arrested Pepijn van der Stap in September.

The investigation follows the theft of sensitive information from the FBI’s online recruitment portal, which reportedly included personnel specializations and medical and psychiatric records.

Reuters had previously reported that suspected ShinyHunters member Saif Al-din Khader, known as “Rey,” was detained and is cooperating with investigators.

Publicly available records do not establish Dubrovsky’s operational role, identify evidence linking him to specific intrusions, or indicate wrongdoing by either cybersecurity company. As a result, significant details remain unavailable for public scrutiny, and the FBI declined to comment to KrebsOnSecurity.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.