Feds Investigate Ransom Negotiators Linked to ShinyHunters Extortion Site
Federal authorities uncover cybersecurity executives allegedly operating extortion portals for the ShinyHunters hacking group.
1Federal Investigation into Extortion
U.S. federal investigators have identified executives at two ransomware negotiation firms maintaining close ties with the ShinyHunters hacking group. Sources indicate one U.S.-based executive actively helped operate a website designed to pressure victims into paying ransoms. This investigation highlights a disturbing intersection between professional cybersecurity services and criminal extortion syndicates.
2ShinyHunters Group Evolution
Since 2019, ShinyHunters has claimed credit for numerous major data breaches. Originally operated by cybercriminals in France, control shifted to a teenage hacker known as Rey from Amman, Jordan. The FBI reports the group has successfully extorted over $70 million from victims during the current year alone, demonstrating significant operational scale.
3FBI Recruitment Site Breach
In late September 2026, ShinyHunters compromised the FBI recruitment portal fbijobs.gov. The stolen data included sensitive medical records, psychological files, and Social Security numbers of employees. This brazen attack prompted the FBI to accelerate arrests and detain individuals suspected of communicating with the group's leadership, including the detained suspect Rey.
4Dutch Arrest Uncovers Plot
On September 15, 2026, Dutch authorities arrested suspect Pepijn van der Stap using flash-bang grenades. While logged into his Signal account, police accessed communications with ransomware negotiators in Canada and the U.S. These messages were instrumental in unraveling a murder-for-hire plot allegedly ordered by Van der Stap, though no attacks occurred.
5Executive Arrest in Canada
On October 9, the FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky. Charged with threatening to disclose stolen data and interfering with interstate commerce, Dubrovsky allegedly maintained frequent contact with Van der Stap. Prosecutors have requested he remain in custody pending trial, with court records currently under seal to protect the investigation.
6Active Role in Extortion
Investigators believe at least one executive at a prestigious U.S. consulting firm with over 1,000 associates played an active role in operating the now-defunct Shinywire extortion website. This portal listed nearly 100 hacked organizations, providing file samples and payment instructions to force victims into compliance before their data was leaked.
7The Shinywire Extortion Mechanism
Active from May 3, 2026, until October 16, the Shinywire site functioned as a dedicated pressure tool for ShinyHunters. Victims who refused to engage within seven days faced the public release of their stolen data on a Tor-based shaming blog. This systematic approach targeted companies like Intuitive Surgical following phishing-based credential compromises.
8Internal Industry Conflicts
Edward Dubrovsky previously filed a lawsuit against former business partner Daniel Tobok, alleging a campaign to destroy his career. Tobok, formerly of the firm Cypfer, faced historical allegations linking him to the nickname Ghostbyte, which appeared in communications with the Dharma ransomware group as early as 2018. These internal disputes highlight complex industry rivalries.
9Corporate Stance on Payments
Cypfer stated it does not facilitate ransomware payments and was unaware of Dubrovsky's arrest until media reports surfaced. The company clarified it is separate from CyberSteward and has not been contacted by law enforcement. Cypfer was recently acquired by Apros Group, led by former FBI special agent Jason Hogg, distancing the firm from past associations.
10Legal Landscape of Ransom
Paying hackers for encryption keys or data deletion is not inherently illegal in the U.S., provided the group is not under Treasury Department sanctions. However, many incident response firms refuse to facilitate these payments. When victims choose to pay, they often switch to firms that lack such ethical qualms, fueling the extortion economy.
11Failure of Data Deletion
The PowerSchool breach in 2024, which compromised 62 million students, illustrates the futility of paying ransoms. Despite a $2.85 million payment, stolen data was later used in secondary extortion attempts against school districts. There is no technical mechanism to verify that hackers actually delete stolen files, making future exploitation an inevitable risk.
12Industry Resistance and Retaliation
Leading response firms like Coveware and Unit 221B actively advise victims against paying ShinyHunters, noting that data is frequently resold. ShinyHunters has retaliated by harassing employees at these firms, explicitly complaining that their advice harms the group's payment rates. This ongoing conflict underscores the high-stakes battle between security professionals and cybercriminals.