The negotiator is charged with extortion

Federal agents on Thursday arrested Edward Dubrovsky, 54, a Canadian ransomware negotiator, in Pennsylvania on extortion conspiracy charges, according to federal court records posted on Friday, CyberScoop reported. The FBI has not publicly named him. The allegations are unproven, and Dubrovsky has not been convicted of anything.

The docket, which spells his name "Dobrovsky", lists two counts. KrebsOnSecurity quoted them as "conspiracy to threaten to impair the confidentiality of information with the intent to extort money," and "interference with commerce by threats." The second, according to the docket text published by BleepingComputer, covers Hobbs Act extortion and conspiracy to commit it. The core complaint is sealed, and Komposite has not reviewed the docket itself.

Gizmodo reported that the complaint was filed in the Eastern District of Texas, and that a magistrate judge in Philadelphia ordered Dubrovsky held and sent to Texas for a detention hearing. CNN reported that he appeared in federal court in Philadelphia on Thursday, where a federal public defender was appointed to represent him. SecurityWeek reported that the FBI's ShinyHunters investigation is reportedly being run from the Texas district. He has not entered a plea, according to Gizmodo. We could not find a date for the hearing.

The link to ShinyHunters comes from reporting rather than from the public record; the filings say nothing about the group or the FBI, Gizmodo noted. FBI Director Kash Patel said on Friday that agents had arrested "another suspected co-conspirator" of the group, without naming anyone. In a statement quoted by ABC News, Patel said: "This arrest demonstrates the strength and reach of our efforts to protect Americans from cybercrime." CNN, citing multiple people familiar with the investigation, tied Dubrovsky to the breach of the FBI's jobs portal, and a law enforcement source told CBS News the Canadian suspect is believed to have been directly involved. BleepingComputer said that with the complaint sealed, it remains unclear what he is accused of or whether the case is connected to the breach.

His professional history is disputed. CyberScoop described him as a founder and former chief operating officer of CYPFER, a Toronto firm that helps organisations negotiate with ransomware operators. A CYPFER spokesperson told Krebs on Saturday that he was never a founder or co-founder, and that he served as a managing director before resigning in November 2025. Politico reported, as relayed by BleepingComputer, that CyberSteward, the firm he is now associated with, is a trade name used by CYPFER. One of Krebs's sources said he was in Philadelphia for the Cyber Risk Summit, a cyber insurance conference held from 5 to 7 October whose biggest sponsor was CYPFER. Neither Dubrovsky nor CYPFER responded to CyberScoop's requests for comment.

ShinyHunters said on 22 September that it had broken into the FBI's jobs website, and CNN reported that the data of thousands of current and former bureau employees was exposed. The FBI alleges that the group has breached more than 140 organisations and taken at least $70m in extortion payments since last year, The Hacker News reported. Two earlier arrests have been tied to the group: Pepijn van der Stap in Amsterdam, and Saif al-Din Khader, known as "Rey", who was detained in Jordan, according to CBS News.

The contractor question is a separate thread. Brett Leatherman, assistant director of the FBI's Cyber Division, said in a statement last Tuesday that a contractor "failed to implement a security patch explicitly issued to secure the platform" and had been removed, NBC News reported. The FBI did not name it. Reuters reported, citing two people familiar with the matter, that the system was Oracle's PeopleSoft human resources platform and the contractor Accenture, which said only that it was "proud to support the mission of the FBI". None of the reporting we reviewed connects the patching failure to the charges against Dubrovsky.

The case lands on an industry that sits between breached companies and their extortionists. Gizmodo noted that Angelo Martino, a former DigitalMint negotiator who pleaded guilty to working with the BlackCat ransomware gang, was sentenced in July to 70 months under the same Hobbs Act statute. Krebs's sources said charges against principals at other ransomware negotiation firms may follow. Nothing public yet says whether the allegations against Dubrovsky concern his negotiation work or something else; the sealed complaint would show it.

Komposite reported in September on ShinyHunters' claim to have entered the FBI's jobs portal through PeopleSoft, and earlier on how cyber insurers have come to set the security baseline for their clients. The next public step in this case is the detention hearing in Texas.