By Sagoh 
Federal Bureau of Investigation agents have arrested a high-profile executive at a Canadian cybersecurity firm in connection with an escalating international investigation into the notorious ShinyHunters hacking collective. The arrest follows a high-stakes cyberattack attributed to the group that compromised sensitive personnel records belonging to thousands of federal law enforcement agents.
According to multiple sources familiar with the matter, the suspect was taken into custody in Pennsylvania while attending a prominent cyber insurance conference. The unfolding operation highlights an intense, cross-border crackdown on ransomware extortionists and the specialized consulting firms that often intersect with them during high-pressure corporate negotiations.
The New York Times reported that federal authorities arrested a Canadian man in Pennsylvania on suspicion of providing assistance to the ShinyHunters organization. While neither the initial reports nor a brief public statement posted to social media by FBI Director Kash Patel explicitly named the individual, federal court records and industry sources have identified the defendant as Edward Dubrovsky, a well-known figure in the cybersecurity community and an author who specializes in ransomware extortion response.
According to sources close to the investigation, Dubrovsky was visiting Pennsylvania to attend the annual Cyber Risk Summit, an industry gathering held at the Loews Philadelphia Hotel. The conference featured numerous sponsors, but according to event documentation, its primary and largest sponsor was Cypfer, a Canadian cybersecurity company specializing in incident response and digital extortion negotiations.
Online professional profiles indicate that Dubrovsky was previously associated with Cypfer. However, following his arrest, a spokesperson for Cypfer clarified that Dubrovsky was never a founder or co-founder of the firm, contrary to claims on his professional network profile. Instead, the company stated that he served as a managing director before ultimately resigning from his position in November 2025. Following his departure from Cypfer, Dubrovsky became associated with CyberSteward, another Canadian security firm and conference sponsor. Approximately one month prior to his arrest, Dubrovsky posted on professional networking platforms to announce his participation in the Philadelphia summit alongside the CyberSteward team.
Federal court filings show that an individual named Edward Dobrovsky—with a minor spelling variation in the surname—was arrested on October 8 in Pennsylvania. He faces federal charges including conspiracy to threaten to impair the confidentiality of information with the intent to extort money, as well as interference with commerce by threats. While the core complaint and several related documents remain sealed by the court, a summary of the charges was indexed by legal research databases, confirming the nature of the allegations against him.
U.S. Bureau of Prisons inmate records indicate that a 54-year-old Edward Dubrovsky is currently being held at a federal detention facility in Philadelphia. However, court dockets reveal that the case was ordered to be transferred to the U.S. District Court for the Eastern District of Texas on October 9. Sources indicate that the Eastern District of Texas has become the central operational hub for the FBI’s sweeping investigation into the ShinyHunters network. The FBI has thus far declined to comment on the specifics of the arrest.
Dubrovsky is widely recognized within the cybersecurity industry as an expert on ransomware and digital extortion. His professional profile highlights his authorship of a 252-page book titled Cyber Extortion Strategic Response, which is marketed as a guide to navigating the complex decisions organizations face during ransomware incidents. Promotional material for the book emphasizes the distinction between communicating with cybercriminals and agreeing to pay ransom demands, noting that engagement can serve tactical objectives such as testing attacker claims, gathering intelligence, buying time, and preserving options.
Legal representation for Dubrovsky has not yet been publicly established. Available court records indicate that he does not currently retain private counsel, and a public defender has not yet been formally appointed by the court. Attempts to reach Dubrovsky and executives at CyberSteward for comment immediately following the arrest were unsuccessful.
The arrest of the cybersecurity executive represents a significant escalation in the federal government’s pursuit of ShinyHunters, a cybercrime syndicate that has wreaked havoc across corporate and government sectors. The group typically gains unauthorized access by utilizing phishing tactics and stolen corporate credentials to siphon proprietary data from Software-as-a-Service platforms. Victims are subsequently threatened with the public release of their confidential data unless exorbitant ransom demands are satisfied. According to federal estimates, the group has successfully extorted more than $70 million from various victims throughout the year.
The investigation has accelerated rapidly in recent weeks following a series of international law enforcement actions. Last month, Dutch police apprehended Pepijn van der Stap, a reformed hacker suspected of playing a major role in the ShinyHunters operation. Investigators have spent weeks analyzing digital devices seized during Van der Stap’s arrest. Sources close to the inquiry suggest that additional charges against key figures at other firms specializing in ransomware negotiations could be forthcoming as prosecutors untangle the network’s operations.
The pressure on investigators intensified dramatically in the wake of Van der Stap’s arrest when an individual operating under the online pseudonym "Rey" assumed leadership of the ShinyHunters faction. The new leader began taunting federal law enforcement online, highlighting a major security breach in which the group penetrated the FBI’s online recruitment portal. The stolen cache included sensitive personal data belonging to prospective and active federal personnel, detailing unit assignments, specialized skills, and confidential medical and psychiatric records.
Law enforcement efforts soon closed in on the online persona. Reuters reported that "Rey" was identified as a teenager named Saif Al-din Khader. Khader was subsequently detained and began cooperating with federal investigators. Court and investigative records revealed that Khader was apprehended as the cybercrime group attempted to execute an extortion scheme against a digital aviation and navigation unit that had been divested by Boeing.
Nila Kartika Wati 
Dwi Wanna