Canadian ransomware negotiator Edward Dubrovsky arrested in FBI probe

A Canadian ransomware negotiator and cybersecurity executive was arrested in Pennsylvania amid an escalating international crackdown by federal authorities targeting the hacking collective known as ShinyHunters.

Federal court documents filed in the Eastern District of Pennsylvania outline charges against Edward Dubrovsky, including conspiracy to threaten the confidentiality of information to extort money, alongside interference with commerce, according to reporting by Fox Business. Partially sealed court records note conflicting spellings of his surname, shifting between Dubrovsky and Dobrosky, and omit formal listings of his age, profession, or employer. A person briefed on the matter confirmed to The Globe and Mail that the individual in custody is the Canadian cybersecurity executive. Dark-web intelligence records preserved by District 4 Labs and federal prison records identify him as a resident of Richmond Hill, north of Toronto. Federal prison records show that a 54-year-old named Edward Dubrovsky is being held at a federal detention center in Philadelphia.

Media additions

The arrest coincides with a sweeping global investigation led by the Federal Bureau of Investigation into the ShinyHunters hacking group. The collective rattled federal law enforcement by allegedly stealing information concerning nearly every employee. Ground News noted that multiple sources connecting the dots to KrebsOnSecurity and The New York Times indicated the detained Canadian man was suspected of assisting the hacking ring. When queried by Reuters regarding the detention, the FBI referred inquiries to a public statement issued by FBI Director Kash Patel.

Patel revealed in a post on X that agency field agents had arrested another suspected co-conspirator linked to the ShinyHunters group. While Patel highlighted the ongoing dismantling of the network, he did not explicitly name the suspect in his statement. Authorities have maintained caution, noting that public confirmation connecting Dubrovsky directly to the bureau's data breach remains unverified by official spokespersons. Federal prosecutors in Philadelphia did not return messages seeking comment regarding the spelling discrepancies in court filings, and attempts to reach Dubrovsky and his legal representation were unsuccessful.

Dubrovsky's professional footprint spans years of advising corporate entities on cyberattacks, ransom demands, and threat actor engagement. His LinkedIn profile associates him with CyberSteward, a firm advertising expertise in threat actor engagement, complex cyber-extortions, and settlement facilitation. Multiple reports indicate he built a career helping organizations navigate the complex legal and financial terrain of paying cybercriminals.

A federal court order issued in Pennsylvania revealed that prosecutors requested the defendant's detention. A judge ordered him held pending a detention hearing, and a subsequent order directed the U.S. Marshals Service to transport him to Texas for further judicial proceedings, as the underlying criminal case is handled through the Eastern District of Texas.