Federal agents have arrested a Canadian cybersecurity professional in Pennsylvania, linking him to an ongoing investigation into the ShinyHunters hacking group. Edward Dubrovsky, co-founder of the Canadian firm CyberSteward, was taken into custody on October 8, facing charges of conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference with commerce by threats.
Dubrovsky was reportedly attending the Cyber Risk Summit in Philadelphia, held from October 5 to 7, when the arrest occurred. His company, CyberSteward, specializes in ransomware negotiation and advisory services. Prior to co-founding CyberSteward, Dubrovsky was also a co-founder of another Canadian security company, Cypfer. His LinkedIn profile indicates his expertise in "strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services." He is also the author of "Cyber Extortion Strategic Response," a book detailing approaches to ransomware negotiations.
Court records initially listed Dubrovsky's last name as "Dobrovsky" but confirmed his identity and age as 54. While the initial arrest was in Pennsylvania, the case has since been moved to the Eastern District of Texas, which sources indicate is a central hub for the FBI's ShinyHunters investigation. Many documents related to the case remain sealed.
The ShinyHunters group is known for using phishing and stolen credentials to exfiltrate data from corporate accounts, particularly those at software-as-a-service companies. They then threaten to publish the stolen data unless a ransom is paid. The FBI estimates the group has extorted over $70 million from victims this year alone.
The arrest of Dubrovsky follows earlier developments in the ShinyHunters investigation. Last month, Dutch police arrested Pepijn van der Stap, a convicted cybercriminal, in connection with the group. Following Van der Stap's arrest, another ShinyHunters member, known as "Rey," reportedly took over the group and publicly taunted the FBI after the group stole data from the agency's online recruitment portal. This stolen data allegedly included details on agents' units, specializations, and medical and psychiatric records.
More recently, "Rey" was identified as Saif Al-din Khader, a teenager who has reportedly been detained and is cooperating with FBI investigators. Khader was allegedly apprehended while attempting to extort a navigation and digital aviation unit that had been divested by Boeing in late 2025.
The FBI has not issued an official comment on Dubrovsky's arrest or the ongoing investigation. Dubrovsky currently does not have legal representation listed in the available court records. Sources suggest that further charges against individuals at other companies specializing in ransomware negotiation may be forthcoming as the investigation progresses.
