Canadian Ransomware Negotiator Held on Extortion Charges as FBI Pursues ShinyHunters. Case Is Sealed in Texas

Since ShinyHunters claimed last month to have stolen data on nearly every FBI employee, the bureau has moved to dismantle the group. This week that effort reached a Canadian cybersecurity executive.

Edward Dubrovsky, 54, was arrested Thursday, Oct. 8, in the Philadelphia area. Federal court filings in the Eastern District of Pennsylvania list two charges: conspiracy to "threaten to impair the confidentiality of information with intent to extort money," and interference with commerce.

No one has said publicly what he is accused of doing.

What the court filings show

The core complaint is sealed. The filings that remain visible spell the defendant's surname as "Dobrovsky" or "Dobrosky" and list no age, profession or employer.

A person briefed on the matter told Reuters the defendant is Dubrovsky. Federal Bureau of Prisons records show a 54-year-old Edward Dubrovsky held at the Federal Detention Center in Philadelphia, with a release date listed as unknown. Federal prosecutors in Philadelphia did not answer repeated questions about the name discrepancies.

A judge ordered him held pending a detention hearing in the Eastern District of Texas. A notice filed Friday, Oct. 9, moved the case there, and a separate order that day directed the U.S. Marshals Service to transport him to Texas. The Texas case is sealed.

The ShinyHunters link

On Friday, FBI Director Kash Patel posted on X that agents had arrested "another suspected co-conspirator of the ShinyHunters group," which he called the group believed responsible for the recent FBIjobs.gov incident on a platform managed by a third-party vendor. He said it was the latest arrest tied to the network in a matter of days. He did not name the person.

When asked about Dubrovsky, the FBI pointed to Patel's post and declined further comment. Authorities have not publicly confirmed that Dubrovsky is the person Patel described.

Sources close to the investigation told KrebsOnSecurity that he is. One said the man was in Pennsylvania for a cyber insurance conference. Another said control of the ShinyHunters investigation has been centralized at an FBI field office in Texas. Those are anonymous accounts, and no charging document made public so far mentions ShinyHunters.

The Cyber Risk Summit ran at the Loews Philadelphia Hotel from Oct. 5 to Oct. 7. Dubrovsky had said on LinkedIn about a month earlier that he planned to attend with the rest of the CyberSteward team.

Who he is

Dubrovsky's LinkedIn profile lists him with CyberSteward, a Canadian firm that advertises "threat actor engagement, cyber-extortions, complex negotiations, and settlement facilitation." In the LinkedIn post about the summit, he described the firm's work as "compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services."

His profile also lists a past role at Cypfer, another Canadian security firm. A Cypfer spokesperson said he was not a founder or co-founder, as the profile claims. The spokesperson said he was a managing director who resigned in November 2025.

Wallet records leaked in 2010 and preserved by the dark-web intelligence firm District 4 Labs identify a Dubrovsky living in Richmond Hill, north of Toronto, and put his current age at 54.

Reuters could not reach Dubrovsky or his attorneys. It also could not reach CyberSteward.

The open questions

The charges are accusations, not findings. Nothing public says Dubrovsky took part in the theft of FBI data. The extortion-conspiracy charge, as written in the filings, could describe a range of conduct, and the sealed complaint is the only place it is spelled out.

The case also reaches into a trade that sits close to the line. Negotiators and settlement facilitators deal directly with criminal groups on behalf of victims and insurers. Whether prosecutors allege he crossed from intermediary to participant is the question the sealed filings would answer. Dubrovsky has not responded publicly, and no attorney has spoken for him.

Patel's description of the FBIjobs.gov incident puts the breach on a third-party vendor's platform. The FBI has not said which vendor or how many employees' records were exposed. ShinyHunters itself said the haul covered nearly every FBI employee, and the claim has not been independently verified.

Next up is the detention hearing in the Eastern District of Texas. No date has been made public. Whether the judge unseals the complaint, and what it says about Dubrovsky's alleged role, will determine whether the Texas case is about a hacking group's crew or about the people who negotiate with it.