Federal Bureau of Investigation agents have arrested a prominent executive at a Canadian cybersecurity firm in connection with an escalating international investigation into the notorious ShinyHunters hacking group. The arrest comes on the heels of a massive data breach by the cybercrime syndicate that compromised sensitive personnel records belonging to thousands of FBI agents, according to multiple sources familiar with the matter.
The high-stakes arrest was first reported by The New York Times, which confirmed that a Canadian man had been taken into custody in Pennsylvania on suspicion of assisting ShinyHunters. While neither The Times nor a statement posted to Twitter/X by FBI Director Kash Patel explicitly named the individual at the time of the initial reports, sources speaking on the condition of anonymity provided clearer details to KrebsOnSecurity.
According to sources close to the unfolding investigation, the arrested Canadian executive was visiting Pennsylvania to attend a prominent cyber insurance conference. Investigators believe the suspect’s professional background—specifically specializing in navigating complex ransomware negotiations and cyber extortion advisory services—intersected with the illicit activities of the hacking group. Furthermore, sources indicated that control over the sprawling federal investigation has recently been centralized at an FBI field office in Texas, signaling a major push by federal prosecutors.
Public records and online registrations confirm that the Cyber Risk Summit was held at the Loews Philadelphia Hotel from October 5 to October 7. While the major industry conference featured various sponsors, its primary and largest backer was Cypfer, a Canadian security company specializing in digital risk management.
According to professional networking profiles, Cypfer was previously associated with Edward Dubrovsky, who later transitioned to another Canadian security firm and conference sponsor, CyberSteward. Approximately one month prior to his arrest, Dubrovsky shared a post on LinkedIn announcing his plans to travel to Philadelphia to attend the Cyber Risk Summit alongside his colleagues from the CyberSteward team.
A spokesperson for Cypfer subsequently clarified that Dubrovsky was never a founder or co-founder of the firm, despite claims on his LinkedIn profile, but rather served as a managing director before ultimately resigning in November 2025.
In a public social media post prior to the conference, Dubrovsky wrote that he was looking forward to continuing strategic conversations around compliant-driven coercive ransomware advisory, negotiations, and global settlement services.
Federal court records reveal that on October 8, an individual named Edward Dobrovsky—noting a slight misspelling of the surname—was taken into custody in Pennsylvania and hit with formal charges including cyber extortion and conspiracy. While several key documents, including the primary criminal complaint, have been sealed by the court, a handful of filings were indexed on CourtListener.com. These accessible summaries charge the defendant with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, alongside charges of interference with commerce by threats.
The inmate locator maintained by the U.S. Bureau of Prisons lists a 54-year-old Edward Dubrovsky as currently being held at a federal detention facility in Philadelphia. However, court dockets show that a notice was filed on October 9 transferring the case to the U.S. District Court for the Eastern District of Texas, which sources identify as the current epicenter of the comprehensive federal probe into ShinyHunters. The FBI has consistently declined to comment on the specifics of the ongoing investigation.
Dubrovsky’s professional background includes authorship of "Cyber Extortion Strategic Response," a 252-page publication that purports to guide organizations through the complex decision-making processes required during ransomware attacks. An excerpt from the book’s promotional material emphasizes a core distinction in crisis management: communicating with a cybercriminal is fundamentally distinct from negotiating a payment, and negotiation does not equate to a commitment to pay. The text argues that active engagement can serve alternative strategic objectives, such as testing attacker claims, gathering intelligence, buying time, and preserving institutional options while leadership evaluates its next steps.
At the time of his arraignment, Dubrovsky had not yet retained private legal representation, and court records indicated that a public defender had yet to be formally appointed. Representatives for CyberSteward could not be immediately reached for comment regarding the arrest.
The ShinyHunters group has long established a modus operandi centered on leveraging phishing campaigns and stolen credentials to infiltrate corporate accounts at major software-as-a-service providers. Once inside, the group steals proprietary data and threatens to publish it publicly unless a substantial cryptocurrency ransom is paid. According to federal estimates, the syndicate has successfully extorted more than $70 million from corporate and institutional victims over the course of the year.
Law enforcement pressure on the group has intensified significantly in recent weeks. Sources indicate that FBI investigators have been poring over digital devices seized last month when Dutch authorities arrested Pepijn van der Stap, a reformed hacker suspected of playing a key role in the ShinyHunters operation. Investigators are reportedly evaluating whether additional charges against executives and principals at other firms specializing in ransomware negotiation may be forthcoming.
The arrest also follows a period of brazen escalation by the hacking collective. Immediately following Van der Stap’s apprehension, a prominent member of ShinyHunters operating under the alias "Rey" assumed leadership of the group and began publicly taunting federal authorities. The taunts referenced a major breach of the FBI’s online recruitment portal, which exposed sensitive files detailing agents’ units, specialized skills, and confidential medical and psychiatric records.
Reuters previously reported that "Rey"—subsequently identified as a teenager named Saif Al-din Khader—had been detained by authorities and was cooperating with federal investigators. Court and investigative records detail how Khader was apprehended as the cybercrime unit attempted an extortion scheme against a digital aviation and navigation unit that had been divested by Boeing in late 2025.
