He Wrote the Book on Ransomware Negotiations. The FBI Just Charged Him With Cyber Extortion.

On September 24, two days after the ShinyHunters hacking group defaced the FBI's jobs website with a fake seizure banner, a 54-year-old Canadian ransomware negotiator named Edward Dubrovsky self-published a book on Amazon. Its title: Cyber Extortion Strategic Response, a guide to ransomware negotiations.

Two weeks later, on October 8, federal agents arrested Dubrovsky in Pennsylvania on conspiracy and extortion charges. The complaint, filed in the Eastern District of Texas, remains under seal. The next day, FBI Director Kash Patel announced on X that agents had arrested "another suspected co-conspirator of the ShinyHunters group," without naming him. Two people with knowledge of the case told the New York Times that the arrest was tied to the breach that exposed data on thousands of FBI employees.

The arrest

According to the federal docket in Philadelphia, which misspells his last name as "Dobrovsky," Dubrovsky is charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, along with Hobbs Act extortion and conspiracy to commit Hobbs Act extortion. A magistrate judge ordered him held and sent him to Texas for a detention hearing. He has not been convicted or entered a plea, and Politico reported that he could not be reached for comment.

The public filings themselves say nothing about ShinyHunters or the FBI, and Patel did not name the suspect in his announcement. But CNN, through multiple people familiar with the investigation, and CBS News, through a law enforcement source, also tied the defendant to the FBI hack. Politico sounded a note of caution: it is unclear whether Dubrovsky's case is connected to the FBI breach, though the timing of the two cases lines up, and the charges center on extortion rather than the intrusion itself.

Who is Edward Dubrovsky?

Dubrovsky built his career on the victim side of the ransom table. When Cypfer, a Toronto incident-response and ransomware recovery firm, hired him as a managing director in 2022, its press release described a 30-year industry veteran with CISSP, OSCP, and PMP certifications and a seat on York University's cybersecurity advisory board. "Clients who have been the victims of ransomware need to get up-and-running as soon as possible," he said at the time.

The details of his resume are now contested. On LinkedIn he described himself as Cypfer's chief operating officer and an "ex-founder," a label the company rejects. A Cypfer spokesperson told security journalist Brian Krebs that Dubrovsky was never a founder, that he served as a managing director, and that he resigned last November. He is now associated with CyberSteward, a ransom negotiation firm that Politico reported litigation had identified as a trade name for Cypfer. Reuters identified him as a resident of Richmond Hill, north of Toronto; federal prison records show a 54-year-old Edward Dubrovsky detained at a federal detention center in Philadelphia.

One of Krebs's sources said Dubrovsky was in Philadelphia for the Cyber Risk Summit, a cyber insurance conference that ended the day before his arrest, with Cypfer as its biggest sponsor. Before the event he had written on LinkedIn that he looked forward to conversations around "strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic." He had even shared a stage with the bureau that now holds him: an InfraGard agenda from the RSA Conference in April 2025 lists him on two panels alongside agents from the FBI's San Francisco cyber branch.

In his book, Dubrovsky wrote that "communicating with a criminal is not the same thing as negotiating a payment, and negotiating is not a commitment to pay." Prosecutors now accuse the negotiator of crossing exactly that line.

The ShinyHunters manhunt

The backdrop is one of the most audacious hacks the FBI has suffered in years. On September 22, ShinyHunters posted a fake seizure banner on FBIjobs.gov. Within two days, outlets reviewing a leaked spreadsheet of roughly 5,000 alleged FBI officials found records that appeared to identify members of the bureau's own hacking unit. On September 29, an internal memo told staff to assume the worst: "We are operating under the premise that the threat actor is also exfiltrating [personally identifiable information] of all F.B.I. employees," the memo reportedly said.

Dubrovsky's arrest is the third in a crackdown that has moved across three countries. Around September 15, before the FBI hack, Dutch police arrested alleged ShinyHunters leader Pepijn van der Stap, whom Krebs identified as a convicted cybercriminal known as "Umbreon." (The group has denied any association with him.) Jordanian authorities then detained Saif al-Din Khader, a suspected member known as "Rey," who is reportedly cooperating with the FBI. On October 9, the bureau told The Register it had worked with partners to arrest "multiple subjects."

FBI Cyber Division Assistant Director Brett Leatherman blamed a contractor that failed to apply a security patch to the third-party platform hosting the jobs site. "As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce," he said in a statement reported by ABC News. Leatherman has said ShinyHunters breached more than 140 organizations and extorted $70 million since last year, according to the New York Times, and the group has since walked back its implied threat to publish the FBI data.

A negotiator class under scrutiny

The Dubrovsky case lands amid a grim run of headlines for the ransomware recovery industry. The day before his arrest, Zohar Pinhasi, owner of Florida-based MonsterCloud, was arraigned in Brooklyn on wire fraud charges in an unrelated case. Prosecutors allege his firm billed victims for a decryptor it did not have and quietly paid the hackers instead: hundreds of companies paid MonsterCloud more than $19 million while Pinhasi paid cybercriminals more than $8 million in ransoms. He pleaded not guilty.

The closer parallel is Angelo Martino, a former negotiator at DigitalMint who pleaded guilty in April to working with the BlackCat/ALPHV ransomware gang. The attackers paid Martino for his clients' confidential negotiating positions, and he teamed up with two other cybersecurity workers to deploy BlackCat against more victims, including one extorted for about $1.2 million in bitcoin. In July he was sentenced to 70 months in prison for conspiring to interfere with interstate commerce through extortion, the same Hobbs Act statute cited in Dubrovsky's complaint.

What happens next

For now, the public record is thin by design. The complaint is sealed, the docket misspells the defendant's name three ways, and prosecutors in Philadelphia have not commented. What is known is that a man who built a career advising victims on how to deal with criminals is being held in federal detention in Philadelphia, awaiting transfer to Texas for a detention hearing, charged with the very crime he wrote a book about surviving.

Krebs reported that the FBI has been sifting through devices seized when van der Stap was arrested, and that principals at other ransomware negotiation companies could soon face charges. Whether Dubrovsky's case is the climax of the ShinyHunters crackdown or a separate thread, the message to the industry is already legible: the people who sit between victims and criminals are now being watched as closely as the criminals themselves.