Canadian Negotiator Arrested as Reports Tie Case to ShinyHunters

Edward Dubrovsky, 54, was arrested October 8 in Pennsylvania on sealed extortion charges that some reports link to ShinyHunters’ FBI jobs-site breach, a tie others say is unconfirmed.

Edward Dubrovsky, 54, a Canadian cybersecurity executive and ransomware negotiator who founded or led CYPFER and has been linked to CyberSteward, was arrested on October 8, 2026, in Pennsylvania—reportedly in Philadelphia, and in one account at the Philadelphia Cyber Risk Summit—and transferred toward the Eastern District of Texas pending a detention hearing, with the complaint still sealed. Outlets disagree on the precise charges, citing conspiracy to extort together with Hobbs Act extortion, interference with commerce by threats, or a conspiracy under 18 U.S.C. 1030(a)(7)(B) to threaten the confidentiality of information in order to extort money. Several reports tie the arrest to ShinyHunters and the September 2026 FBIjobs.gov intrusion, and one says court documents and an October 9 statement by FBI Director Kash Patel identify him as a suspected co-conspirator, while others say Patel did not name him and the FBI has not publicly confirmed his role. On the intrusion, sources say an Accenture contractor left Oracle PeopleSoft unpatched on a third-party platform; attackers allegedly reached AWS GovCloud and took about 2–3 terabytes that may include names, Social Security numbers, addresses, emergency contacts, and medical data for thousands of FBI employees, including counterintelligence staff, although the group claimed records on nearly all agents and applicants. The FBI is quoted as saying ShinyHunters and associates hit more than 140 organizations and took over $70 million in the past year, with other reports placing that sum in 2026. Dubrovsky is called the third recent suspect held after arrests in the Netherlands and Jordan, but only one outlet names Pepijn van der Stap and 17-year-old Saif Al-din Khader, and the Jordan date is given as both September 28 and September 29; a separate report also records the surnames Dobrovsky and Dobrosky, a Cypfer role from 2022 through 2025, and a FileFlex advisory seat.

• Edward Dubrovsky, 54, a Canadian ransomware negotiator who founded or led CYPFER and is linked to CyberSteward, was arrested Oct. 8, 2026, in Pennsylvania; one report places it at the Philadelphia Cyber Risk Summit.
• The complaint is sealed and the case was moved toward the Eastern District of Texas, where he is to be held pending a detention hearing.
• Charge descriptions differ: conspiracy to extort plus Hobbs Act extortion, interference with commerce by threats, and, in one report, 18 U.S.C. 1030(a)(7)(B).
• Some outlets tie him to ShinyHunters and the September 2026 FBIjobs.gov breach and cite an Oct. 9 statement by FBI Director Kash Patel; others say Patel did not name him and the FBI has not confirmed his role.
• The FBI breach is attributed to unpatched Oracle PeopleSoft on an Accenture-run third-party platform, an alleged move into AWS GovCloud, and theft of about 2–3TB that may include SSNs and other employee data.
• The FBI is cited as saying ShinyHunters hit more than 140 organizations and took over $70 million in the past year or in 2026.
• He is called the third recent suspect after arrests in the Netherlands and Jordan; only one report names Pepijn van der Stap and 17-year-old Saif Al-din Khader, and the Jordan date is given as both Sept. 28 and Sept. 29.
• One report says he was a Cypfer executive from 2022 through 2025 and a FileFlex adviser, and records alternate spellings Dobrovsky and Dobrosky.