--- title: Feds Suspect Ransom Negotiator Ran ShinyHunters... description: Federal investigators pursuing the ShinyHunters extortion group have found that executives at two ransomware negotiation firms maintained unusually close ties... canonical: https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security | daily.dev og:description: Federal investigators pursuing the ShinyHunters extortion group have found that executives at two ransomware negotiation firms maintained unusually close ties... og:url: https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d og:image: https://api.daily.dev/og/posts/28MzUwI7d.png og:image:alt: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security **[Krebs on Security](https://daily.dev/sources/krebsonsecurity)** · 13 min read · 0 upvotes · 0 comments ## Summary Federal investigators pursuing the ShinyHunters extortion group have found that executives at two ransomware negotiation firms maintained unusually close ties with the hackers, with one U.S. executive allegedly helping operate the ShinyHunters extortion website 'shinywire.com'. Canadian cybersecurity executive Edward Dubrovsky was arrested and charged with extortion-related offenses, and chat logs from arrested hacker Pepijn van der Stap reportedly show Dubrovsky knew about the FBI data breach before it became public but never warned the bureau. The reporting also details a lawsuit between Dubrovsky and former business partner Daniel Tobok (nicknamed 'Ghostbyte'), ShinyHunters' harassment of firms like Coveware and Unit 221B for advising against ransom payments, and recent DOJ prosecutions of other ransomware negotiators (MonsterCloud's Zohar Pinhasi, Angelo Martino) accused of secretly colluding with or defrauding clients. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Who was arrested in connection with the ShinyHunters FBI data breach investigation? Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and former managing partner at Cypfer, was arrested by the FBI and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. Investigators allege his Signal chats with arrested hacker Pepijn van der Stap showed he knew about the stolen FBI personnel data before it became public and never alerted the bureau. _Security teams tracking ransomware negotiator accountability follow cases like this on daily.dev._ ### How much money has the ShinyHunters hacking group extorted from victims? ShinyHunters has extorted more than $70 million from victims in a single year, according to the FBI. The group, now reportedly controlled by a teenage hacker known as Rey based in Amman, Jordan, has claimed credit for dozens of major breaches since 2019, including the FBI's own recruitment site and the PowerSchool breach affecting 62 million students. _Developers weighing breach-response decisions track extortion group activity like this on daily.dev._ ### Should a company pay a ransom demand from the ShinyHunters hacking group? Incident response firms including Coveware and Unit 221B have consistently warned victims against paying ShinyHunters, noting that stolen data is often kept, resold, or used for repeat extortion even after payment. The FBI issued a formal alert on May 15, 2026 advising against paying the group, and PowerSchool's $2.85 million ransom payment in 2024 did not prevent later extortion attempts using the same stolen records. _Teams building an incident-response playbook weigh pay-or-not tradeoffs like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 3 discussions and 101 comments across hackernews (as of 2026-10-21). **TL;DR:** Discussion centers less on the specific negotiator allegations and more on broader distrust of federal competence and the ethics of ransomware payments, with heavy skepticism toward both the FBI's handling and the ransom-negotiation industry's incentives. **Sentiment:** 5% positive · 35% mixed · 60% skeptical **The case for** - Some argue negotiators are mostly professional and that a minority of bad actors shouldn't tarnish the whole field. - A few note the underlying incentive structure (building trust between victim and attacker) explains why legitimate-seeming negotiators are valuable even if it creates conflict-of-interest risk. **The pushback** - Many doubt the FBI's claims, noting the reporting is mostly Krebs' own research rather than confirmed federal statements. - Commenters criticize the FBI/government for repeated security failures (unpatched CVEs, reduced cybersecurity staffing) despite having had years to improve since the OPM breach. - Several argue ransom negotiators as a class have perverse incentives (percentage cuts, pressuring victims to pay) that could encourage collusion with attackers. - Strong disagreement over whether banning ransom payments would reduce crime or simply cause more harm to victims. **By community** - hackernews (heated): The thread splits into a sprawling, contentious debate about government cybersecurity incompetence, offense/defense asymmetry in security, and the ethics of paying ransoms, with relatively little sustained focus on the negotiator allegations themselves. **Hottest debate:** Whether ransom payments should be made illegal to starve criminal enterprises, versus the view that banning payments would simply cost lives and shift crime elsewhere. **Open questions** - What specific incentive structures caused some negotiation firms to collude with ransomware groups rather than act purely in clients' interests? - Will the federal investigation produce confirmed, non-anonymous findings beyond what Krebs' sources have reported? **Highlights** > I believe the incentive is that they help establish a reputable connection between the ransomware group and the victim. From what I have read in the past is that victims have no reason to trust ransomware groups and pay because what is stopping them from just demanding more money or hacking the company again. So from what I read is that ransomware companies depend on building a trust that after payment you will get your data back and he left alone. So I believe that by working with a ransomware negotiator, a company that assumingly is a legitimate lawful business, the victim and hacker both benefit with the trust that this middleman is legit and the working history established has shown that those who pay do end up getting their data back. TLDR: why believe a hacker that if you pay they will actually leave you alone. But a legitimate middleman with a history of dealing with these things and a proven track record can establish immediately confidence that paying will result in data recovery. So it's not about a lower price but rather a confidence you won't get screwed after paying. > — [14 on hackernews](https://news.ycombinator.com/item?id=50177244) > Did everyone in this comment section just miss the fact that the contents of the article are primarily Krebs’ research? The feds haven’t actually said anything publicly. Krebs cites someone close to the investigation, but that’s it. > — [Aurornis on hackernews · 1 comments](https://news.ycombinator.com/item?id=50175230) > No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data. For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay. Other actors though have a reputation to uphold to get paid and they know it. An example of the process is something like: 1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings. 2. Negotiators notified. 3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”. > — [ofjcihen on hackernews · 2 comments](https://news.ycombinator.com/item?id=50174555) > What kind of incentive structure do most ransomware negotiation firms use that would actually cause them to benefit from coordination with the ransomware groups, as happened in this case? Do ransomware negotiators get paid more if they negotiate a lower price? > — [markasoftware on hackernews · 2 comments](https://news.ycombinator.com/item?id=50176978) > Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed. > — [nradov on hackernews · 1 comments](https://news.ycombinator.com/item?id=50174773) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50173487) · 203 points · 101 comments - [hackernews](https://news.ycombinator.com/item?id=50153523) · 9 points · 0 comments - [hackernews](https://news.ycombinator.com/item?id=50162571) · 2 points · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security","url":"https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d"},"datePublished":"2026-10-19T13:55:45.913Z","dateModified":"2026-10-21T09:53:13.327Z","description":"Federal investigators pursuing the ShinyHunters extortion group have found that executives at two ransomware negotiation firms maintained unusually close ties...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ef06f270ad9985293d2df657c4bb811?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ef06f270ad9985293d2df657c4bb811?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Krebs on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Krebs on Security","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/deb3e417ddef4d0e8cc4d704becf6004","url":"https://daily.dev/sources/krebsonsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,data-breach","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Krebs on Security","item":"https://daily.dev/sources/krebsonsecurity"},{"@type":"ListItem","position":3,"name":"Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security-28mzuwi7d#faq","mainEntity":[{"@type":"Question","name":"Who was arrested in connection with the ShinyHunters FBI data breach investigation?","acceptedAnswer":{"@type":"Answer","text":"Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and former managing partner at Cypfer, was arrested by the FBI and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. Investigators allege his Signal chats with arrested hacker Pepijn van der Stap showed he knew about the stolen FBI personnel data before it became public and never alerted the bureau. Security teams tracking ransomware negotiator accountability follow cases like this on daily.dev."}},{"@type":"Question","name":"How much money has the ShinyHunters hacking group extorted from victims?","acceptedAnswer":{"@type":"Answer","text":"ShinyHunters has extorted more than $70 million from victims in a single year, according to the FBI. The group, now reportedly controlled by a teenage hacker known as Rey based in Amman, Jordan, has claimed credit for dozens of major breaches since 2019, including the FBI's own recruitment site and the PowerSchool breach affecting 62 million students. Developers weighing breach-response decisions track extortion group activity like this on daily.dev."}},{"@type":"Question","name":"Should a company pay a ransom demand from the ShinyHunters hacking group?","acceptedAnswer":{"@type":"Answer","text":"Incident response firms including Coveware and Unit 221B have consistently warned victims against paying ShinyHunters, noting that stolen data is often kept, resold, or used for repeat extortion even after payment. The FBI issued a formal alert on May 15, 2026 advising against paying the group, and PowerSchool's $2.85 million ransom payment in 2024 did not prevent later extortion attempts using the same stolen records. Teams building an incident-response playbook weigh pay-or-not tradeoffs like this on daily.dev."}}]} ```