What Happened

Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive who has worked for firms that negotiate with ransomware and extortion gangs on behalf of victims, was arrested in Pennsylvania on Oct. 8 and charged in a federal extortion case, according to court records reported by CyberScoop and Reuters. Krebs on Security first reported the arrest and traced the suspect's background.

Dubrovsky is a co-founder and former chief operating officer of Cypfer, a Toronto-based ransomware-response firm, according to CyberScoop. His LinkedIn profile also lists an affiliation with CyberSteward, another Canadian firm that helps breach victims negotiate ransom payments.

He is charged with conspiracy to threaten the confidentiality of information to extort money, a violation of the federal computer-fraud law, and conspiracy to commit extortion under the Hobbs Act, a federal anti-extortion statute, CyberScoop reported. Other details of the case remain sealed. The docket, which spells his name “Dobrovsky,” shows the case moved to the Eastern District of Texas, and he will be detained until a detention hearing is scheduled.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Dubrovsky and Cypfer did not respond to CyberScoop's requests for comment, and no attorney statement has been reported. The FBI did not publicly announce the arrest and pointed reporters to a social media post by Director Kash Patel.

Patel said Friday that agents had arrested “another suspected co-conspirator of the ShinyHunters group” earlier in the week, without naming the person, the charges or the person's alleged role. The New York Times reported that a Canadian man had been arrested in Pennsylvania in connection with the case. Krebs's sources also tied the arrest to the FBI's ShinyHunters investigation, but no official source has linked Dubrovsky to the group by name.

Why It Matters

FBI cyber official Brett Leatherman said ShinyHunters and its associates have breached more than 140 organizations and collected at least $70 million in extortion payments since last year, according to Nextgov/FCW.

Negotiators see a victim's most sensitive information during a crisis, including how badly it was hit and how much it can pay. The case gives boards and general counsel reason to review the response firms named in their incident plans and on insurer panels, including who holds the channels to attackers, how payments are approved and whether a negotiator's account of the talks can be independently checked.

The charges have not been tested in court, and Dubrovsky is presumed innocent.

Earlier Arrests

In September, the group took over the FBIjobs.gov recruiting site and stole data on nearly every FBI employee, according to The Record. The Primary Wire reported Oct. 3 that an alleged member had been detained in Jordan and is reportedly cooperating with the FBI, and that Dutch police had arrested another suspect. On Oct. 6, The Primary Wire reported that the FBI blamed the intrusion on a contractor's missed security patch.

ShinyHunters told several outlets it will not publish the stolen FBI data. Nextgov/FCW noted that unpublished data can still be sold.

What to Watch

Next steps include Dubrovsky's detention hearing in the Eastern District of Texas, whether prosecutors unseal the rest of the case, whether the FBI confirms a link to ShinyHunters and whether principals at other negotiation firms are charged. Cypfer, CyberSteward and cyber insurers may also face questions about how they vet negotiators.

Sources