A Ransomware Negotiator Was Supposed to Be on Your Side. Now He's Charged With Extortion.
Edward Dubrovsky, a well-known incident-response executive, faces federal charges that may tie him to ShinyHunters, the group that broke into an FBI jobs site last month.
Key points
- Edward Dubrovsky, 54, was charged under the Computer Fraud and Abuse Act (18 U.S.C. § 1030(a)(7)(B)) for allegedly conspiring to extort money by threatening to expose private information.
- FBI Director Kash Patel publicly linked a recent Canadian arrest in Pennsylvania to ShinyHunters, the criminal group behind a breach of FBIjobs.gov, a platform used to hire FBI staff.
- Dubrovsky's case was transferred to Texas, where sources say active ShinyHunters investigations are based, suggesting he may be the person Patel referenced.
- Two other ransomware negotiators faced separate criminal charges in the same week, raising fresh questions about oversight in the incident-response industry.
- The core complaint remains sealed, so the full scope of the alleged conduct is not yet public.
Ransomware negotiators occupy a narrow, strange corner of the security world. When a hospital or a school gets hit by criminals who lock up their files until a ransom is paid, these specialists step in as go-betweens. They talk to the criminals, push the payment down, and try to get operations running again. The whole point is that they work for the victim.
Edward Dubrovsky built a visible career doing exactly that.
What is he accused of?
Dubrovsky allegedly crossed the line from negotiator to extortionist. The charge is conspiracy to threaten to expose confidential information in order to extract money, under a section of the Computer Fraud and Abuse Act, the main US federal law covering computer-related crimes. The core complaint is still sealed, so many details are not yet public.
Before the charges, Dubrovsky was an executive at incident-response firm Cypfer from 2022 through the end of 2025. He sat on the advisory board of FileFlex, a cybersecurity product vendor, and had recently been publicly active with a firm called CyberSteward, attending a conference in Philadelphia. A self-published guidebook on responding to cyber-extortion and regular appearances in industry press, including Dark Reading, which first reported on the charges, had made him a recognisable name on the beat.
Is this connected to the FBI site breach?
Probably, though the connection is not confirmed in public court documents.
FBI Director Kash Patel posted on Friday that the bureau had arrested "another suspected co-conspirator of the ShinyHunters group," the criminal collective believed responsible for breaking into FBIjobs.gov, a third-party site used to post jobs and collect applications for the FBI itself. ShinyHunters claimed to have stolen data belonging to nearly every FBI employee and job applicant listed on the platform.
Patel did not name the suspect. Dubrovsky is Canadian, was arrested in Pennsylvania, and his case was transferred to Texas, where sources told KrebsOnSecurity that ShinyHunters investigations are currently centralised. The New York Times reported Friday that the FBI had arrested a Canadian man in Pennsylvania in connection with ShinyHunters, and the overlap is hard to ignore.
We covered the original FBIjobs.gov claim on 28 September in "ShinyHunters Claims FBI Hack Exploiting Oracle Flaw", and followed it on 7 October when Jordanian authorities detained the group's alleged leader in "A teenage hacker, a Boeing spin-off, and the Oracle flaw tying them together". ShinyHunters operates as a loose collective that specialises in stealing data and threatening to publish it unless victims pay. These are unverified criminal claims, not confirmed breaches.
Should this worry people who hire ransomware negotiators?
Yes, at least at the level of due diligence. Dubrovsky isn't an isolated case. In the same week, Zohar Pinhasi of MonsterCloud was arraigned on wire fraud charges for allegedly telling clients he could recover their data without paying criminals, then secretly paying the criminals anyway and charging victims a heavy markup. We reported the Pinhasi indictment on 11 October in "MonsterCloud Owner Charged After Secretly Paying Ransoms While Billing Clients $19 Million for 'Decryption'". A third negotiator, Angelo Martino, was previously convicted for feeding information directly to the BlackCat ransomware group in exchange for money.
Three cases in quick succession is not a coincidence. It's a pattern that points to weak vetting inside a loosely regulated industry.
Jeff Wichman, senior director of breach preparedness at security firm Semperis, told Dark Reading that these incidents will likely push negotiation firms toward stronger background checks and attract closer scrutiny from the insurance companies that back them. That pressure is overdue. Handing your incident to someone whose incentives you can't verify is its own kind of risk, and MFA won't fix that one.
