The FBI Arrested a Ransomware Negotiator at a Cyber Insurance Conference in Its Hunt for ShinyHunters

Companies hit by ransomware hire negotiators to talk to the criminals for them. Now the FBI has arrested one of those negotiators and charged him with conspiring in cyber extortion, in the same investigation that is chasing the gang that breached the FBI itself.

Edward Dubrovsky, a 54-year-old Canadian, was arrested in Pennsylvania on Thursday, October 8. He had come to the area for a cyber insurance conference, and his company specialized in ransomware negotiations, KrebsOnSecurity reported. The Cyber Risk Summit ran October 5 to 7 at the Loews Philadelphia Hotel. Dubrovsky had posted that he would attend with the team from CyberSteward, a Canadian firm and one of the event's sponsors.

Two charges, a sealed complaint

Court records list him (misspelled as "Edward Dobrovsky") on two counts: "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." The second is a Hobbs Act extortion charge. The core complaint is sealed.

A Philadelphia magistrate judge ordered him held and sent to the Eastern District of Texas for a detention hearing, Gizmodo reported. Sources describe that district as the epicenter of the ShinyHunters probe. He has not entered a plea and has not been convicted of anything.

The public filings say nothing about ShinyHunters or the FBI. But two people told The New York Times that federal authorities view him as a principal co-conspirator in the group's attack on the bureau, and CNN and CBS tied the defendant to the FBI hack through their own sources. FBI Director Kash Patel posted that the bureau had arrested "another suspected co-conspirator" without naming him. Patel called it "the latest arrest this FBI has made in a matter of days involving this network."

A career built on talking to extortionists

Dubrovsky's LinkedIn describes him as a founder of Cypfer, the summit's biggest sponsor. Cypfer disputes that. A spokesperson told Krebs he was never a founder or co-founder but a managing director who resigned in November 2025.

He also wrote a 252-page book, "Cyber Extortion Strategic Response." Its Amazon listing argues that "communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay." Ahead of the conference he posted that he was looking forward to conversations about "compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic."

The ShinyHunters dragnet

ShinyHunters phishes and steals credentials to siphon data out of companies' SaaS accounts, then threatens to publish it. The FBI says the group has extorted more than $70 million this year, with past victims including Instructure, Salesforce, Snowflake and McKesson.

Its most embarrassing hit was the FBI's own online recruitment portal, where the group took data including units, specializations, and medical and psychiatric records. FBI cyber chief Brett Leatherman said the breach came through a third-party platform where a contractor had not installed a security patch. Reuters reported that contractor worked for Accenture.

The bureau is moving fast. The investigation has already turned a ShinyHunters member: Rey, identified by Reuters as teenager Saif Al-din Khader, was detained and is cooperating. Sources say agents are also combing devices seized when Dutch police arrested Pepijn van der Stap last month.

Those same sources told Krebs that charges against principals at other ransomware negotiation companies may be coming. It would not be the first crack in that industry this week, after a ransomware recovery boss was charged with secretly paying attackers. For businesses that hand these firms the keys to their worst day, the people across the table are suddenly under scrutiny too. Dubrovsky did not respond to requests for comment, and the FBI declined to comment.

Some offers on this page may be paid placements or contain affiliate links.