The Federal Bureau of Investigation arrested the co-founder of a Canadian cybersecurity company on Thursday in connection with an investigation targeting the ShinyHunters hacking collective, which recently obtained sensitive FBI information affecting thousands of agents, according to multiple sources familiar with the case. The New York Times reported the arrest of a Canadian national in Pennsylvania on suspicion of supporting ShinyHunters, though neither the Times nor FBI Director Kash Patel's statement on X identified the individual by name.
An investigation source indicated the arrested Canadian was in Pennsylvania attending a cyber insurance conference and that his company provided ransomware negotiation services with criminal organizations. The ShinyHunters investigation has been consolidated at an FBI field office in Texas, another source disclosed.
The Cyber Risk Summit took place at the Loews Philadelphia Hotel from October 5 through October 7, with a Canadian security company called Cypfer listed as the event's primary sponsor. LinkedIn records identify Cypfer's co-founder as Edward Dubrovsky, a Canadian who now works with another Canadian security firm, CyberSteward. Approximately one month prior to the conference, Dubrovsky posted on LinkedIn that he planned to attend with his CyberSteward colleagues.
Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic
Edward Dubrovsky, LinkedIn post
Federal court filings show that on October 8, an Edward Dobrovsky (with a slight variation in spelling) was arrested in Pennsylvania facing cyber extortion and conspiracy charges. Most court documents, including the primary complaint, have been sealed, though summaries indexed on Courtlistener.com describe charges of "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." The U.S. Bureau of Prisons inmate locator lists a 54-year-old Edward Dubrovsky currently detained at a federal facility in Philadelphia. However, a notice filed October 9 transferred the case to the Eastern District of Texas, which sources identify as the focal point of the FBI's ShinyHunters investigation. The FBI declined to provide comment.
Dubrovsky's LinkedIn profile identifies him as author of Cyber Extortion Strategic Response, a 252-page work addressing organizational response and recovery decisions. An Amazon excerpt from the book states: "At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay. Engagement can serve other objectives, including testing claims, gathering information, creating time, and preserving options while the organization evaluates its next move."
Dubrovsky could not be reached for immediate comment. Attempts to contact CyberSteward's other co-founder have also been made. Court records indicate Dubrovsky currently lacks legal representation and has not yet had a public defender assigned.
ShinyHunters Operations and Broader Investigation
ShinyHunters typically employs phishing tactics and compromised credentials to extract data from software-as-a-service company accounts, subsequently threatening to release stolen information unless ransom payments are made. The FBI reports the group has extracted over $70 million from victims during the current year.
Investigation sources indicate the FBI has been analyzing devices seized when Dutch police apprehended convicted cybercriminal Pepijn van der Stap last month as part of the ShinyHunters probe. Additional charges against executives at other ransomware negotiation firms may follow, sources suggest.
Following Van der Stap's arrest, a ShinyHunters member using the alias "Rey" took operational control and began publicly mocking the FBI regarding data stolen from the agency's online recruitment system, which contained personnel unit assignments, specializations, medical records, and psychiatric information.
Reuters reported last week that Rey—identified as teenager Saif Al-din Khader—had been apprehended and was assisting FBI investigators. On October 7, reporting detailed how Rey's capture occurred as the cybercrime group allegedly attempted to extort a navigation and digital aviation division that Boeing divested in late 2025.