# Feds Investigate Ransom Negotiators Linked to ShinyHunters Extortion Site Federal authorities uncover cybersecurity executives allegedly operating extortion portals for the ShinyHunters hacking group. - **Source:** [Hacker News: Front Page](https://brifing.si/source/b07aa772-b1a0-4a76-aa18-719c6f9e2dde) - **Published:** 2026-10-20 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/62e81bdd-2f20-405b-a3f2-77638e2ca156 ## Federal Investigation into Extortion U.S. federal investigators have identified executives at two ransomware negotiation firms maintaining close ties with the ShinyHunters hacking group. Sources indicate one U.S.-based executive actively helped operate a website designed to pressure victims into paying ransoms. This investigation highlights a disturbing intersection between professional cybersecurity services and criminal extortion syndicates. ## ShinyHunters Group Evolution Since 2019, ShinyHunters has claimed credit for numerous major data breaches. Originally operated by cybercriminals in France, control shifted to a teenage hacker known as Rey from Amman, Jordan. The FBI reports the group has successfully extorted over $70 million from victims during the current year alone, demonstrating significant operational scale. ## FBI Recruitment Site Breach In late September 2026, ShinyHunters compromised the FBI recruitment portal fbijobs.gov. The stolen data included sensitive medical records, psychological files, and Social Security numbers of employees. This brazen attack prompted the FBI to accelerate arrests and detain individuals suspected of communicating with the group's leadership, including the detained suspect Rey. ## Dutch Arrest Uncovers Plot On September 15, 2026, Dutch authorities arrested suspect Pepijn van der Stap using flash-bang grenades. While logged into his Signal account, police accessed communications with ransomware negotiators in Canada and the U.S. These messages were instrumental in unraveling a murder-for-hire plot allegedly ordered by Van der Stap, though no attacks occurred. ## Executive Arrest in Canada On October 9, the FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky. Charged with threatening to disclose stolen data and interfering with interstate commerce, Dubrovsky allegedly maintained frequent contact with Van der Stap. Prosecutors have requested he remain in custody pending trial, with court records currently under seal to protect the investigation. ## Active Role in Extortion Investigators believe at least one executive at a prestigious U.S. consulting firm with over 1,000 associates played an active role in operating the now-defunct Shinywire extortion website. This portal listed nearly 100 hacked organizations, providing file samples and payment instructions to force victims into compliance before their data was leaked. ## The Shinywire Extortion Mechanism Active from May 3, 2026, until October 16, the Shinywire site functioned as a dedicated pressure tool for ShinyHunters. Victims who refused to engage within seven days faced the public release of their stolen data on a Tor-based shaming blog. This systematic approach targeted companies like Intuitive Surgical following phishing-based credential compromises. ## Internal Industry Conflicts Edward Dubrovsky previously filed a lawsuit against former business partner Daniel Tobok, alleging a campaign to destroy his career. Tobok, formerly of the firm Cypfer, faced historical allegations linking him to the nickname Ghostbyte, which appeared in communications with the Dharma ransomware group as early as 2018. These internal disputes highlight complex industry rivalries. ## Corporate Stance on Payments Cypfer stated it does not facilitate ransomware payments and was unaware of Dubrovsky's arrest until media reports surfaced. The company clarified it is separate from CyberSteward and has not been contacted by law enforcement. Cypfer was recently acquired by Apros Group, led by former FBI special agent Jason Hogg, distancing the firm from past associations. ## Legal Landscape of Ransom Paying hackers for encryption keys or data deletion is not inherently illegal in the U.S., provided the group is not under Treasury Department sanctions. However, many incident response firms refuse to facilitate these payments. When victims choose to pay, they often switch to firms that lack such ethical qualms, fueling the extortion economy. ## Failure of Data Deletion The PowerSchool breach in 2024, which compromised 62 million students, illustrates the futility of paying ransoms. Despite a $2.85 million payment, stolen data was later used in secondary extortion attempts against school districts. There is no technical mechanism to verify that hackers actually delete stolen files, making future exploitation an inevitable risk. ## Industry Resistance and Retaliation Leading response firms like Coveware and Unit 221B actively advise victims against paying ShinyHunters, noting that data is frequently resold. ShinyHunters has retaliated by harassing employees at these firms, explicitly complaining that their advice harms the group's payment rates. This ongoing conflict underscores the high-stakes battle between security professionals and cybercriminals. ## Sources covering this story - https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._