Summary
- U.S. and Canadian cybersecurity executives linked to ransomware negotiation firms are under FBI investigation for alleged collusion with the ShinyHunters hacking group.
- Canadian executive Edward Dubrovsky, 54, has been arrested and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion.
- Investigators believe an unnamed executive at a large U.S. consulting firm helped operate ‘shinywire.com’, ShinyHunters’ victim-pressure website, which listed nearly 100 organisations.
- Van der Stap’s Signal messages, accessed during his arrest in the Netherlands, reportedly showed negotiators knew about breaches before victims did — including the FBI’s own data theft.
- The DOJ has separately charged or convicted multiple ransomware negotiators in recent months for conspiring with attackers against their own clients.
The investigation
U.S. federal investigators probing the ShinyHunters hacking group have turned their attention to executives at two ransomware negotiation firms, according to reporting by KrebsOnSecurity. The group, which the FBI says has extorted more than $70 million from victims this year alone, hacked the FBI’s own recruitment website fbijobs.gov in late September, stealing medical and psychological records, Social Security numbers, home addresses, and personnel information. That brazen attack accelerated the bureau’s efforts to identify and question anyone with connections to the group.
The arrests and the Signal intercept
The breakthrough reportedly came from an unexpected source. On 15 September, Dutch authorities arrested Pepijn van der Stap, a convicted hacker and ShinyHunters suspect, using flash-bang grenades while he was actively logged in to online accounts including Signal. That live access allowed investigators to read recent communications with contacts that included ransomware negotiators in Canada and the United States. Those messages are now said to be central to the broader investigation, including the unravelling of a murder-for-hire plot that Dutch outlet RTL has reported may have been ordered by Van der Stap — though there is no indication the orders were carried out.
The Canadian arrest
On 9 October, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters investigation. Dubrovsky, who recently published a book recommending that organisations engage with hackers during extortion events, faces charges of threatening to disclose stolen data and interfering with interstate commerce through extortion. Court records indicate prosecutors have sought to keep him in custody pending trial and that related records remain under seal. Sources told KrebsOnSecurity that Van der Stap’s Signal messages showed Dubrovsky knew ShinyHunters had stolen data from FBI servers and did not report the breach to the bureau before the group went public with the threat.
The extortion website
Separately, investigators believe at least one executive at a U.S.-based consulting firm — described as prestigious, with more than 1,000 staff — played an active role in operating shinywire.com, a now-defunct website that listed nearly 100 organisations hacked by ShinyHunters. The site, active from approximately 3 May to 16 October, urged victims to contact the group and negotiate payment, published samples of stolen files, and warned that non-responsive victims would have their data published on a Tor-accessible shaming blog within seven days. KrebsOnSecurity has not named the firm or the executive, as no charges have been filed.
Industry conflict of interest
The investigation has shone a light on a structural problem in the ransomware response industry. Mark Camillo, chief executive of CyberAcuView — an industry group backed by major cyber insurers — noted that some firms charge a percentage of the final ransom paid rather than a flat fee. ‘This makes no sense if they are also the negotiator,’ he said, pointing to an inherent financial incentive to facilitate payment rather than resist or reduce it. This model, he said, lacks transparency and creates misaligned incentives throughout the ecosystem. The DOJ has moved on several cases reflecting this concern: MonsterCloud CEO Zohar Pinhasi was charged on 7 October with wire fraud for allegedly paying hackers $8 million while charging clients $19 million; and in July, ransomware negotiator Angelo Martino was sentenced to 70 months in prison for feeding confidential client negotiating positions to the Blackcat/ALPHV group.
The payment dilemma
Paying ShinyHunters has not guaranteed outcomes for victims. PowerSchool reportedly paid a $2.85 million ransom in late 2024, assisted by CyberSteward — a firm Dubrovsky was associated with — only for individual school districts to receive fresh extortion demands using the same stolen data by May 2025. Firms including Coveware and Unit 221B have publicly advised against paying ShinyHunters, warning that data described as deleted is often retained, resold, or reused. The FBI echoed this advice in a May 2026 alert. ShinyHunters, for their part, have been actively hostile toward those firms: Telegram messages obtained by KrebsOnSecurity show the group complaining that Coveware was costing them payments and stating they were trying to ‘eliminate the problem.’
Why it matters
This case forces a direct question for any CISO engaged with a ransomware incident: can you verify your incident response partner’s independence from the threat actor? The ShinyHunters investigation suggests negotiators with insider access to attacker operations may be operating inside reputable firms. Beyond the immediate legal exposure of working with a compromised intermediary, the PowerSchool case demonstrates that paying a ransom provides no durable guarantee — the same data can and has been used for repeat extortion. CISOs must scrutinise fee structures, demand disclosure of any prior dealings with known threat groups, and consider whether their insurer’s preferred vendor has been independently vetted.
What to do now
- Review fee arrangements with any ransomware response or negotiation firm engaged on your behalf — flat fees and percentage-of-ransom models carry different incentive structures, and the latter warrants elevated scrutiny.
- Ask your cyber insurer and legal counsel to confirm that recommended incident response vendors have not been flagged in any law enforcement investigations.
- Do not treat a ransom payment as a data-deletion guarantee; assume stolen data may persist and factor ongoing exposure into your breach response and notification decisions.
- Consult the FBI’s May 2026 alert advising against paying ShinyHunters before making any payment decision involving that group.
- Ensure your incident response retainer agreement requires the vendor to immediately notify you if they become aware of any law enforcement interest in their principals or if they have prior knowledge of a breach affecting your organisation.
