By Jia Lissa 
Federal Bureau of Investigation agents in Pennsylvania have arrested a prominent Canadian cybersecurity executive on federal cyber extortion and conspiracy charges, marking a dramatic escalation in the ongoing, high-stakes international investigation into the notorious ShinyHunters hacking collective.
The arrest of 54-year-old Edward Dubrovsky, a senior figure in the Canadian cybersecurity community and an authority on ransomware negotiations, stems from suspicions that he aided the digital extortion syndicate. The group recently managed to breach FBI systems, relieving the federal law enforcement agency of sensitive internal data concerning thousands of its agents.
The high-profile detention was first reported by The New York Times, which noted that a Canadian man had been apprehended in Pennsylvania on suspicion of assisting ShinyHunters. While neither the initial newspaper report nor a subsequent public statement posted to social media by FBI Director Kash Patel explicitly named the suspect, multiple sources familiar with the investigation confirmed to KrebsOnSecurity that Dubrovsky was the individual taken into federal custody.
According to sources close to the unfolding federal inquiry, Dubrovsky was visiting Pennsylvania to attend a prominent cyber insurance industry gathering known as the Cyber Risk Summit. The conference was held at the Loews Philadelphia Hotel. Investigators have learned that Dubrovsky’s professional background heavily specialized in handling delicate ransomware negotiations and extortion advisories on behalf of corporate victims dealing with sophisticated cybercriminal gangs.
Online records and conference documentation indicate that the multi-day summit featured several high-profile sponsors, with the event’s premier sponsor being a Canadian security firm operating under the name Cypfer. While professional networking profiles on LinkedIn previously associated Dubrovsky with Cypfer as an ex-founder, a corporate spokesperson clarified that Dubrovsky was never a founder or co-founder of the firm. Instead, he served as a managing director before ultimately tendering his resignation in November 2025.
Following his departure from Cypfer, Dubrovsky became affiliated with another Canadian security firm and conference sponsor, CyberSteward. Approximately a month prior to his arrest, Dubrovsky published posts on professional networking platforms announcing his intention to travel to the Philadelphia summit alongside members of the CyberSteward team. In those public posts, Dubrovsky expressed enthusiasm for continuing industry dialogues regarding global, platform-agnostic strategies for managing coercive cyber extortion, ransomware negotiations, and settlement services.
Federal court documentation indicates that an individual identified as Edward Dobrovsky—featuring a slight phonetic misspelling of his last name—was formally booked in Pennsylvania on October 8 on charges of conspiracy to threaten to impair the confidentiality of information with the intent to extort money, alongside charges of interference with commerce by threats. While the core criminal complaint and a substantial portion of the related court documents have been placed under seal by the judiciary, a handful of procedural files were successfully indexed on CourtListener.com. These records include summaries outlining the specific statutory violations alleged by federal prosecutors.
The U.S. Bureau of Prisons inmate locator confirmed that an individual matching Dubrovsky’s age and background is currently being detained at a federal holding facility in Philadelphia. However, court filings show that the case is already shifting geographic centers. A transfer notice filed on October 9 moved official proceedings to the U.S. District Court for the Eastern District of Texas, which multiple sources identify as the central command hub for the broader, multi-jurisdictional ShinyHunters investigation. Officials with the FBI have consistently declined to comment on the specifics of the ongoing judicial proceedings.
Dubrovsky is widely known within the cybersecurity industry as an author and subject-matter expert on corporate crisis management. His professional background includes writing a 252-page text titled Cyber Extortion Strategic Response, a publication marketed as a comprehensive guide designed to navigate organizations past initial ransom demands and into the critical decision-making processes required for corporate recovery. Promotional excerpts from the book emphasize a core strategic distinction that Dubrovsky frequently championed in his professional engagements: that active communication with a malicious actor is distinct from negotiating a payment, and that entering negotiations does not constitute an explicit commitment to transfer funds. According to the text, opening channels of engagement can serve alternative tactical objectives, such as verifying threat actor claims, gathering actionable intelligence, buying valuable operational time, and preserving organizational options while leaders evaluate their next steps.
At the time of his detention, available court dockets indicated that Dubrovsky had not yet retained private legal representation, nor had the court formally appointed a public defender to manage his defense. Representatives for CyberSteward could not be reached immediately for comment regarding the arrest of their associated executive.
The federal crackdown on individuals suspected of supporting or participating in the ShinyHunters collective comes as law enforcement agencies ramp up pressure on the cybercrime network following a series of brazen digital attacks. ShinyHunters has established a fearsome reputation in the cybersecurity landscape by utilizing targeted phishing campaigns and compromised corporate credentials to siphon proprietary data from Software-as-a-Service providers. The group routinely threatens to publish the pilfered intellectual property and sensitive corporate files on public leak sites unless exorbitant financial demands are met. According to internal law enforcement assessments cited by the FBI, the syndicate has successfully extorted more than $70 million from corporate and organizational victims during the current calendar year alone.
Investigators are currently poring through electronic devices and digital evidence seized during a pivotal law enforcement raid last month. In that operation, Dutch police apprehended Pepijn van der Stap, a reformed cybercriminal whose alleged ties to the collective brought him back into the crosshairs of international investigators. Sources indicate that as the net tightens around the operational core of the network, federal prosecutors may be preparing additional criminal charges against principals at other corporate entities that specialize in ransomware negotiation and incident response.
The pressure on the hacking collective intensified dramatically immediately following the arrest of Van der Stap. In the wake of that law enforcement action, a prominent member of ShinyHunters operating under the digital handle "Rey" assumed leadership over the group’s operations. In an aggressive display of bravado, the newly empowered hacker began openly taunting the FBI regarding a high-profile breach in which the collective exfiltrated sensitive internal data from the bureau’s own online recruitment portal. The stolen files reportedly contained detailed personal information regarding aspiring law enforcement personnel, including unit assignments, professional specializations, and confidential medical and psychiatric records.
Investigative reporting by Reuters revealed that the individual operating behind the alias "Rey" was actually a teenager named Saif Al-din Khader. Authorities successfully detained Khader, who subsequently began cooperating with federal investigators. Court filings and investigative disclosures detailed how Khader was apprehended just as the cybercrime unit allegedly attempted an extortion scheme against a digital aviation and navigation unit that had been divested by aerospace giant Boeing in late 2025.
As federal authorities continue to evaluate seized hardware, coordinate across international borders, and prosecute individuals allegedly tied to the criminal enterprise, the federal investigation into ShinyHunters remains dynamic.
Nila Kartika Wati 
Sagoh 
Dwi Wanna