--- title: FBI arrests Cypfer co-founder Edward Dubrovsky in... description: The FBI arrested Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and a ransomware negotiation professional, as a primary co-conspirator in... canonical: https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters investigation | daily.dev og:description: The FBI arrested Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and a ransomware negotiation professional, as a primary co-conspirator in... og:url: https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku og:image: https://api.daily.dev/og/posts/IBbHCKhKu.png og:image:alt: FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters investigation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters investigation **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary The FBI arrested Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and a ransomware negotiation professional, as a primary co-conspirator in the ShinyHunters extortion group. He was detained in Pennsylvania at a cyber insurance conference and faces cyber extortion and conspiracy charges, with the case now centralized in the Eastern District of Texas. Other recent arrests include Dutch suspect Pepijn van der Stap, a cooperating suspect detained in Jordan, and a teenage member known as Rey who is also cooperating. ShinyHunters claims it breached FBI systems via an alleged Oracle PeopleSoft zero-day, moving laterally into FBI-managed AWS GovCloud infrastructure and stealing 2-3TB of sensitive data. The group has reportedly extorted over $70 million this year and has a history of SaaS phishing and SSO vishing campaigns against companies like Google, Cisco, Okta, and Microsoft. ## Content The FBI has arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware negotiator, in connection with the ShinyHunters extortion group. FBI Director Kash Patel announced the arrest. The New York Times described the suspect as a Canadian citizen arrested in Pennsylvania and a primary co-conspirator. ## The arrest Dubrovsky co-founded the Canadian incident-response firm Cypfer, where he was COO, and is now associated with CyberSteward. Reports say he was picked up at a cybersecurity or cyber insurance conference in Pennsylvania. He is charged with conspiracy to commit extortion under the Computer Fraud and Abuse Act. Court records show the case has moved to the Eastern District of Texas, where the ShinyHunters investigation is now centralized. KrebsOnSecurity suggests more charges against principals of ransomware negotiation firms may follow. ## The FBI breach ShinyHunters hit a third-party jobs platform used by the FBI. The group told BleepingComputer it exploited an Oracle PeopleSoft flaw (CVE-2026-35273), then moved laterally into FBI-managed AWS GovCloud infrastructure. It says it took 2-3TB of data, including employee Social Security numbers, home addresses and medical records. Other accounts say a contractor, reportedly Accenture, failed to apply a patch for the vulnerability. The group also claimed the stolen data identified agents and their intelligence roles, which one account called a counterintelligence disaster. ShinyHunters has reportedly breached more than 140 organizations and extorted about $70 million since 2025. Its record includes SaaS and Salesforce-related thefts affecting Google, Cisco, PornHub and Match Group, plus SSO vishing campaigns against Okta, Microsoft and Google accounts. ## A group under pressure Dubrovsky is not the first arrest. Pepijn van der Stap was arrested in the Netherlands. A teenage member known as Rey was detained in Jordan and is reportedly cooperating with investigators. A key representative's Telegram account has gone dark, and the original leak site went offline before a new one appeared. The group has said its motives go beyond money and include repairing its reputation after being called violent. ## Not the first negotiator in trouble Other negotiators have faced charges. Zohar Pinhasi was charged with wire fraud for allegedly paying ransomware criminals in secret while overcharging clients. Angelo Martino was convicted of leaking details to the BlackCat ransomware group. One incident response executive expects these cases to bring stricter background checks and heavier scrutiny from insurers. ## What it says about vendor trust The uncomfortable part is who gets access. Ransomware negotiators and incident response firms see an organization's most sensitive breach data, usually during an emergency when nobody has time to look closely at them. Dubrovsky was a prominent figure who sponsored a major cyber risk conference, and that visibility apparently did not prompt much scrutiny. One analyst's recommendations for organizations: - Build a panel of crisis vendors vetted before an incident - Run background checks on the principals, not just the company - Require written conflict-of-interest disclosures - Put technical expertise inside vendor risk teams - Review vendor performance after an incident, not only before hiring ## AI enters the picture On a separate thread, Anthropic's Mythos model has reportedly found a second vulnerability exploited in the wild: an authentication bypass in Rejetto HTTP File Server caused by an insecure random number generator. Human researchers were unlikely to catch that kind of flaw. Podcast hosts discussing the story argued AI is changing both attack and defense, and raised open questions about liability for AI vendors. Anthropic recently reorganized its security and bug-bounty programs. ## Questions this post answers ### Who was arrested in connection with the ShinyHunters FBI breach investigation? Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and now associated with CyberSteward, was arrested in Pennsylvania while attending a cyber insurance conference. He is described as a primary co-conspirator in the ShinyHunters extortion group and faces cyber extortion and conspiracy charges, with the case centralized in the Eastern District of Texas. _Security teams tracking the ShinyHunters case follow developing details like this on daily.dev._ ### How did ShinyHunters claim it breached FBI systems? ShinyHunters told BleepingComputer it exploited an alleged zero-day in Oracle PeopleSoft to gain initial access, then moved laterally into FBI-managed AWS GovCloud infrastructure. The group claims to have stolen 2-3TB of data, including employee Social Security numbers, home addresses, and medical records, and says it has extorted more than $70 million this year. _Developers securing enterprise systems against similar lateral-movement attacks can follow these incidents on daily.dev._ ## Similar posts on daily.dev - [Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security](https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d) · Krebs on Security · 0 upvotes · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters investigation","url":"https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku"},"datePublished":"2026-10-10T00:26:30.351Z","dateModified":"2026-10-16T14:09:26.431Z","description":"The FBI arrested Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and a ransomware negotiation professional, as a primary co-conspirator in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/948e82034b59e2c8eb9114a5c9319818?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/948e82034b59e2c8eb9114a5c9319818?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters investigation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fbi-arrests-cypfer-co-founder-edward-dubrovsky-in-shinyhunters-investigation-ibbhckhku#faq","mainEntity":[{"@type":"Question","name":"Who was arrested in connection with the ShinyHunters FBI breach investigation?","acceptedAnswer":{"@type":"Answer","text":"Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer and now associated with CyberSteward, was arrested in Pennsylvania while attending a cyber insurance conference. He is described as a primary co-conspirator in the ShinyHunters extortion group and faces cyber extortion and conspiracy charges, with the case centralized in the Eastern District of Texas. Security teams tracking the ShinyHunters case follow developing details like this on daily.dev."}},{"@type":"Question","name":"How did ShinyHunters claim it breached FBI systems?","acceptedAnswer":{"@type":"Answer","text":"ShinyHunters told BleepingComputer it exploited an alleged zero-day in Oracle PeopleSoft to gain initial access, then moved laterally into FBI-managed AWS GovCloud infrastructure. The group claims to have stolen 2-3TB of data, including employee Social Security numbers, home addresses, and medical records, and says it has extorted more than $70 million this year. Developers securing enterprise systems against similar lateral-movement attacks can follow these incidents on daily.dev."}}]} ```