FBI ARRESTS ANOTHER SHINYHUNTERS SUSPECT — AND THIS TIME IT'S A CYBERSECURITY EXECUTIVE
Oct 10, 2026
The investigation into notorious hacking and extortion group **ShinyHunters** has taken another unexpected turn. The FBI has arrested a new suspect believed to be connected to the massive breach of its own recruitment system, and reports suggest the person taken into custody is not an ordinary underground hacker but an executive associated with a legitimate cybersecurity company.
FBI Director Kash Patel confirmed the latest arrest on October 9, describing the suspect as an alleged co-conspirator connected to ShinyHunters. The group recently claimed responsibility for stealing enormous amounts of sensitive information from the FBI's recruitment platform, including personal details concerning bureau employees and their families.
According to CBS News and other American media, the suspect is a **Canadian citizen arrested in Pennsylvania**. Sources familiar with the investigation believe he was directly involved in the FBI data breach.
Cybersecurity journalist Brian Krebs subsequently identified the arrested individual as **Edward Dubrovsky**, a co-founder of Canadian ransomware negotiation company Cypfer who has also been associated with CyberSteward, another cybersecurity business.
The FBI has not publicly confirmed Dubrovsky's identity or announced specific criminal charges. His precise alleged role remains unclear, and the accusations have not been proven in court.
### A CYBERSECURITY EXECUTIVE UNDER INVESTIGATION
The reported identity of the suspect makes this arrest particularly unusual. Companies specializing in ransomware negotiations are normally hired to assist victims of cyberattacks, communicate with extortionists and help organizations respond to serious security incidents.
The possibility that an executive from this industry could become a suspect in an investigation involving one of the world's most notorious extortion groups raises serious questions. However, investigators have not publicly established whether the suspect's professional activities had any connection to the alleged criminal conduct.
The arrest comes as investigators continue examining how ShinyHunters managed to compromise the FBI's recruitment infrastructure. The group claimed to have obtained between **two and three terabytes of information**, including sensitive personnel records.
Reuters reported earlier this week that an Accenture contractor working on the affected system had been removed after failing to implement an important security patch. The incident reportedly involved Oracle PeopleSoft software used by a third-party provider.
The breach is particularly alarming because the stolen information could potentially expose federal employees and their families to harassment, identity theft, extortion or other forms of targeting.
### THREE SUSPECTS, THREE COUNTRIES
The latest arrest follows two other significant developments in the international investigation.
In September, Dutch authorities arrested **24-year-old Pepijn van der Stap** in Amsterdam. The FBI described him as an alleged ShinyHunters leader, although the group publicly denied that he belonged to its organization.
Then came the detention of **Saif al-Din Khader**, reportedly known online as "Rey," in Jordan. Reuters reported on October 3 that Khader was cooperating with investigators and helping authorities identify other suspected members through electronic communications and digital evidence.
The latest American arrest now adds another suspect to an investigation involving law enforcement agencies across several countries.
This international pressure appears to have caused significant disruption within ShinyHunters. The group's dark-web leak website disappeared following public warnings from the FBI, while people communicating through a ShinyHunters-linked email address later indicated that the group wanted to avoid further escalation.
Whether those statements genuinely represented the entire organization remains unknown.
### IS SHINYHUNTERS FINALLY FALLING APART?
The FBI appears increasingly confident that the investigation is progressing. Patel has made clear that authorities intend to continue pursuing the remaining members and associates, regardless of where they operate.
The broader investigation is significant because ShinyHunters is not accused of just one major intrusion. According to the FBI, the group and associated actors have allegedly compromised more than **140 organizations since last year**, collecting at least **$70 million in extortion payments**.
But dismantling an organization like ShinyHunters is complicated. Modern cybercrime groups frequently operate through loose networks of individuals who collaborate temporarily, share infrastructure and use multiple online identities. Arresting a prominent member does not necessarily mean the entire organization has disappeared.
What makes the current investigation different is the combination of international arrests, reported cooperation from suspects, seized electronic evidence and the FBI's determination to identify those responsible for the breach of its own systems.
For now, there is no public confirmation that the group's principal leader has been arrested. But with suspects detained in the Netherlands, Jordan and the United States, ShinyHunters appears to be facing one of the most serious law-enforcement challenges in its history.
**The group that once threatened to expose the FBI's secrets is now watching investigators close in on the people allegedly responsible.**
FBI Director Kash Patel confirmed the latest arrest on October 9, describing the suspect as an alleged co-conspirator connected to ShinyHunters. The group recently claimed responsibility for stealing enormous amounts of sensitive information from the FBI's recruitment platform, including personal details concerning bureau employees and their families.
According to CBS News and other American media, the suspect is a **Canadian citizen arrested in Pennsylvania**. Sources familiar with the investigation believe he was directly involved in the FBI data breach.
Cybersecurity journalist Brian Krebs subsequently identified the arrested individual as **Edward Dubrovsky**, a co-founder of Canadian ransomware negotiation company Cypfer who has also been associated with CyberSteward, another cybersecurity business.
The FBI has not publicly confirmed Dubrovsky's identity or announced specific criminal charges. His precise alleged role remains unclear, and the accusations have not been proven in court.
### A CYBERSECURITY EXECUTIVE UNDER INVESTIGATION
The reported identity of the suspect makes this arrest particularly unusual. Companies specializing in ransomware negotiations are normally hired to assist victims of cyberattacks, communicate with extortionists and help organizations respond to serious security incidents.
The possibility that an executive from this industry could become a suspect in an investigation involving one of the world's most notorious extortion groups raises serious questions. However, investigators have not publicly established whether the suspect's professional activities had any connection to the alleged criminal conduct.
The arrest comes as investigators continue examining how ShinyHunters managed to compromise the FBI's recruitment infrastructure. The group claimed to have obtained between **two and three terabytes of information**, including sensitive personnel records.
Reuters reported earlier this week that an Accenture contractor working on the affected system had been removed after failing to implement an important security patch. The incident reportedly involved Oracle PeopleSoft software used by a third-party provider.
The breach is particularly alarming because the stolen information could potentially expose federal employees and their families to harassment, identity theft, extortion or other forms of targeting.
### THREE SUSPECTS, THREE COUNTRIES
The latest arrest follows two other significant developments in the international investigation.
In September, Dutch authorities arrested **24-year-old Pepijn van der Stap** in Amsterdam. The FBI described him as an alleged ShinyHunters leader, although the group publicly denied that he belonged to its organization.
Then came the detention of **Saif al-Din Khader**, reportedly known online as "Rey," in Jordan. Reuters reported on October 3 that Khader was cooperating with investigators and helping authorities identify other suspected members through electronic communications and digital evidence.
The latest American arrest now adds another suspect to an investigation involving law enforcement agencies across several countries.
This international pressure appears to have caused significant disruption within ShinyHunters. The group's dark-web leak website disappeared following public warnings from the FBI, while people communicating through a ShinyHunters-linked email address later indicated that the group wanted to avoid further escalation.
Whether those statements genuinely represented the entire organization remains unknown.
### IS SHINYHUNTERS FINALLY FALLING APART?
The FBI appears increasingly confident that the investigation is progressing. Patel has made clear that authorities intend to continue pursuing the remaining members and associates, regardless of where they operate.
The broader investigation is significant because ShinyHunters is not accused of just one major intrusion. According to the FBI, the group and associated actors have allegedly compromised more than **140 organizations since last year**, collecting at least **$70 million in extortion payments**.
But dismantling an organization like ShinyHunters is complicated. Modern cybercrime groups frequently operate through loose networks of individuals who collaborate temporarily, share infrastructure and use multiple online identities. Arresting a prominent member does not necessarily mean the entire organization has disappeared.
What makes the current investigation different is the combination of international arrests, reported cooperation from suspects, seized electronic evidence and the FBI's determination to identify those responsible for the breach of its own systems.
For now, there is no public confirmation that the group's principal leader has been arrested. But with suspects detained in the Netherlands, Jordan and the United States, ShinyHunters appears to be facing one of the most serious law-enforcement challenges in its history.
**The group that once threatened to expose the FBI's secrets is now watching investigators close in on the people allegedly responsible.**