A Canadian cybersecurity executive specializing in ransomware negotiations has been arrested in the United States on federal extortion charges, amid an FBI investigation into the ShinyHunters hacking group following a major breach of the bureau’s employee data.

Cybersecurity negotiator faces extortion charges. Edward Dubrovsky, 54, was arrested October 8 in Pennsylvania, where he had reportedly traveled to attend a cybersecurity conference. According to federal court records reviewed by KrebsOnSecurity, he faces charges involving conspiracy to threaten the confidentiality of information to extort money and interference with commerce through threats.

Dubrovsky previously held senior positions at Canadian incident-response firm CYPFER and has been associated with CyberSteward, a Toronto-based business specializing in ransomware negotiations and cyber-extortion response. His professional work has included advising organizations dealing with cybercriminal demands.

FBI links arrest to broader hacking crackdown. FBI Director Kash Patel announced October 9 that authorities had detained another suspected co-conspirator associated with ShinyHunters, although he did not publicly identify the individual. The Royal Canadian Mounted Police separately confirmed that a Canadian had been arrested in the United States in connection with the group’s attack on FBI systems.

The arrest follows a September intrusion into FBIjobs.gov, the bureau’s recruitment website. ShinyHunters claimed responsibility for stealing sensitive information concerning thousands of FBI personnel, including home addresses, contact details, medical information and family records.

Unpatched third-party system enabled intrusion. According to reporting by CBS News, FBI officials attributed the compromise to a contractor’s failure to install a security patch on an Oracle PeopleSoft system. The bureau subsequently removed the contractor responsible.

The incident exposed sensitive personnel information through an externally managed system, raising concerns about the security of third-party platforms handling government employee records. The compromised information could also expose personnel and their families to harassment, impersonation and targeted extortion.

Investigation extends across multiple countries. Authorities have detained other suspected ShinyHunters associates in the Netherlands and Jordan as part of an expanding international investigation. The group has been linked to attacks against cloud services and enterprise software platforms, frequently using stolen credentials and social engineering to obtain data before demanding payment.

According to the FBI, ShinyHunters and associated actors have collected more than $70 million in extortion payments over the past year.

The specific allegations underlying Dubrovsky’s arrest remain unclear because the principal criminal complaint is sealed. Although multiple reports have connected his detention to the ShinyHunters investigation, authorities have not publicly established his alleged role in the FBI breach.

The case remains at the allegation stage, with no finding of guilt. Court records indicate that proceedings have been transferred to the Eastern District of Texas.