Feds Investigate Ransom Negotiators Linked to ShinyHunters Extortion Site
Federal authorities uncover cybersecurity executives allegedly operating extortion portals for the ShinyHunters hacking group.
1Federal Probe Into Extortion
U.S. federal investigators have identified executives at two ransomware negotiation firms maintaining close ties with the ShinyHunters hacking group. Sources indicate one U.S.-based executive allegedly helped operate a website designed to pressure victims into paying ransoms. This investigation marks a significant escalation in tracking the facilitators behind major data breaches.
2ShinyHunters Group Evolution
Active since 2019, ShinyHunters has claimed credit for numerous high-profile data breaches. Originally operated by cybercriminals in France, control eventually shifted to a teenage hacker known as Rey, based in Amman, Jordan. The FBI reports the group has successfully extorted over $70 million from various victims throughout the current year.
3FBI Recruitment Site Breach
In late September 2026, ShinyHunters compromised the fbijobs.gov recruitment portal. The attackers threatened to publish sensitive personnel files, including medical records, Social Security numbers, and home addresses. This brazen attack prompted the FBI to accelerate efforts to detain individuals communicating with the group’s leadership, including the suspect identified as Rey.
4Dutch Arrests Uncover Evidence
On September 15, 2026, Dutch authorities arrested suspect Pepijn van der Stap using flash-bang grenades. During the apprehension, police accessed his active Signal account, revealing critical communications with ransomware negotiators in Canada and the U.S. These messages provided investigators with evidence regarding a potential murder-for-hire plot linked to the suspect.
5Executive Charges in Canada
On October 9, the FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky. He faces charges related to threatening to disclose stolen data and interfering with interstate commerce. Prosecutors have requested he remain in custody pending trial, while court records concerning his specific activities remain under seal to protect the ongoing investigation.
6Secret Knowledge of Breaches
Evidence from seized messages suggests Dubrovsky and other consulting executives frequently knew about new ShinyHunters victims before the companies themselves were aware. Investigators discovered that Dubrovsky allegedly knew about the FBI server breach but failed to notify the bureau, even as the hackers publicly threatened to release sensitive personnel information online.
7The Shinywire Extortion Portal
Federal investigators believe at least one executive at a prestigious U.S. consulting firm played an active role in operating the now-defunct extortion site, shinywire.com. The site, active from May to October 2026, listed nearly 100 hacked organizations, providing samples of stolen data to coerce victims into engaging with the cybercrime group.
8Phishing and Victim Targeting
The Shinywire portal indexed specific extortion demands, such as those targeting Intuitive Surgical. The medical technology company was breached in March 2026 after an employee fell for a targeted phishing email. Victims who refused to negotiate within seven days faced the public release of their stolen data on a Tor-based shaming blog.
9Internal Industry Conflicts
Court documents reveal that Edward Dubrovsky previously filed a lawsuit against Daniel Tobok, his former business partner at the cybersecurity firm Cypfer. The legal dispute involved allegations of capricious decision-making and unfair competition. These internal industry tensions have surfaced as federal authorities scrutinize the professional conduct of various high-level cybersecurity consultants.
10Historical Links to Ghostbyte
Former colleagues of Daniel Tobok have associated him with the nickname Ghostbyte, which appeared in communications from the Dharma ransomware group as early as 2018. Dharma representatives previously directed victims to contact a specific email address linked to this alias for payment guarantees, highlighting long-standing patterns of intermediary involvement in ransomware.
11Ransom Payment Dynamics
While paying ransoms is not illegal in the U.S. unless the group is sanctioned, many incident response firms refuse to facilitate these payments. When victims decide to pay, they often switch to firms willing to negotiate. This creates a market where companies without ethical qualms regarding extortionists can gain significant business.
12The Futility of Paying
Despite paying a $2.85 million ransom for the PowerSchool breach, the company faced subsequent extortion attempts using the same stolen data. Experts warn that there is no technical way to verify if hackers delete stolen files. ShinyHunters has even harassed firms like Coveware for advising victims against paying these recurring demands.