Skip to content
NewA calmer, faster ZeroHour
StoryPolicy & legalhigh

Feds suspect US executive helped run ShinyHunters extortion site

3 sources · 3 articlesFirst reported Updated ()3
What's new

October 20: Follow-ups add Dubrovsky’s extortion charges and detention, and disagree on an October 8 versus October 9 arrest.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Investigators suspect an uncharged US consulting executive helped run shinywire.com; Canadian executive Edward Dubrovsky faces extortion charges.

Federal investigators examining ShinyHunters suspect an unnamed executive at a large US consulting firm helped operate shinywire.com, an extortion site that listed nearly 100 organizations from about May 3 through October 16, 2026. The site showed stolen-file samples and warned that nonpayment within seven days could lead to publication on a Tor leak blog. Separately, Canadian executive Edward Dubrovsky was arrested and charged with extortion-related offenses after Signal chats tied to the September 15 arrest of Pepijn van der Stap; those allegations are unproven and are not said to include running the site. Krebs on Security reports the arrest on October 9; Cyber Security News reports October 8. According to the FBI, via KrebsOnSecurity, ShinyHunters has extorted more than $70 million this year, including a late-September hack of fbijobs.gov.

Key facts
  • Unnamed US executive is not charged; Krebs withheld the name and firm.
  • Dubrovsky, 54, was ordered detained and committed to the Eastern District of Texas.
  • GBHackers says charges include threatening to disclose stolen information and extortion.
  • The US firm has more than 1,000 associates, according to sources cited by GBHackers.
  • Intuitive Surgical was listed after a March 2026 phishing-credential theft.
  • fbijobs.gov records reportedly included SSNs, medical details, and personnel data.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 3, 2026shinywire.com extortion site became active, investigators say · Krebs on Security
  2. Sep 15, 2026Pepijn van der Stap arrested in the Netherlands · Krebs on Security
  3. Oct 8, 2026Edward Dubrovsky arrested in Pennsylvania, Cyber Security News reports · Cyber Security News
  4. Oct 9, 2026Edward Dubrovsky arrested, Krebs on Security reports · Krebs on Security
  5. Oct 16, 2026shinywire.com listings continued through this date · GBHackers

What each outlet adds

beyond the shared facts
  • Krebs on SecurityWithholds the uncharged executive’s identity and cites the $70 million FBI figure.
  • GBHackersNames extortion charges, the firm’s size, and Cypfer’s denial.
  • Cyber Security NewsReports an October 8 arrest, age 54, and Texas detention.
Threat actors
ShinyHunters
Victims
FBIIntuitive Surgical
Organizations
FBICypferCyberStewardCoveware
Countries
United StatesCanadaNetherlandsJordanFrance

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Krebs on SecurityFirst report

    FBI suspects a ransom negotiator ran ShinyHunters extortion site

    Sources say an unnamed US consulting executive helped run shinywire.com; that person has not been charged.

  2. · 5d ago GBHackers

    FBI probes alleged ShinyHunters ties to ransom negotiators

    Canadian executive Edward Dubrovsky was arrested and charged with extortion; an unnamed U.S. firm’s executive is also suspected, with no charges yet.

  3. · 5d ago Cyber Security News

    FBI suspects consulting executive helped run ShinyHunters extortion site

    Edward Dubrovsky was arrested October 8; sources say shinywire.com listed nearly 100 organizations through October 16.