The Globe and Mail
· collected 2026-10-12 · by Stefanie Marotta, Jesse Winter
A Canadian cybersecurity executive whose career has focused on helping clients negotiate with ransomware attackers has been arrested in the United States in connection with a hacking group that the FBI says stole a huge trove of sensitive data about the bureau’s own employees, according to court records and Reuters.
uncertain
FBI → focus → records
FBI Director Kash Patel said on social media Friday that the agency had arrested what he described as another suspected co-conspirator of the ShinyHunters group, a collective of hackers who have conducted dozens of data breaches since 2019, including a hack of an FBI database earlier this year.
asserted
who → say → database
Reuters, citing a person familiar with the matter, reported that the person arrested was Edward Dubrovsky, a Canadian who has worked as an executive at numerous cybersecurity firms and has been credited by a former employer with helping thousands of clients recover from cyberattacks.
asserted
thousands → cite → cyberattacks
Court documents from the U.S. District Court for the Eastern District of Pennsylvania reveal that Mr. Dubrovsky has been charged and list two criminal complaints: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats.
asserted
Dubrovsky → reveal → threats
The documents contain unproven allegations and attempts to reach Mr. Dubrovsky were unsuccessful.
asserted
attempts → contain → Dubrovsky
The FBI declined to comment on Sunday, referring instead to Mr. Patel’s earlier social media post.
asserted
FBI → decline → post
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” the post said.
asserted
post → make → leads
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
asserted
they → continue → group
In September, the ShinyHunters hacking group claimed responsibility for the FBI hack, which the bureau said may have compromised the private information of tens of thousands of its employees and applicants.
uncertain
bureau → claim → employees
The group said it had taken action over false allegations contained in an FBI public advisory from May that described the organization as a “cyber criminal group specializing in large-scale data breaches and extortion.”
uncertain
that → say → breaches
U.S. federal prison and court records show that a 54-year-old man named Edward Dubrovsky was detained in Philadelphia and appeared in U.S. court last Thursday.
asserted
man → show → court
The alleged connection between Mr. Dubrovsky and ShinyHunters is not detailed in publicly available documents.
asserted
connection → allege → documents
The court records are partially sealed and include inconsistent spelling of his last name (including Dobrosky and Dobrovsky).
asserted
records → seal → Dobrosky
The records also do not identify his profession or employer.
Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a resident of Richmond Hill, a suburb north of Toronto, and put his current age at 54.
asserted
records → identify → 54
RCMP spokesperson Ian Lordon said Friday “the RCMP is aware of the arrest of a Canadian in the U.S. in connection with the ShinyHunters hack,” but directed all further questions to the FBI.
Global Affairs Canada did not respond to a request for comment.
Over the past three decades, Mr. Dubrovsky held several senior positions in the cybersecurity field, according to his LinkedIn profile.
uncertain
Dubrovsky → say → profile
In a LinkedIn post from last week, Mr. Dubrovsky is seen in photographs posing with colleagues and signing copies of his recently published book at the NetDiligence conference in Philadelphia.
asserted
Dubrovsky → see → Philadelphia
He wrote about his excitement at attending the conference with digital security company CyberSteward, which is also displayed in his profile photo.
asserted
which → write → photo
CyberSteward did not return a request for comment.
asserted
CyberSteward → return → comment
His LinkedIn profile lists his most recent permanent post as at CYPFER, a global cybersecurity firm based in Miami, Fla., with offices in Toronto.
asserted
profile → list → Toronto
The company provides services in cybersecurity breaches, cyberextortion, and ransomware recovery and negotiations.
asserted
company → provide → breaches
In a 2022 press release announcing Mr. Dubrovsky’s appointment as managing director, CYPFER described him as a “30-year veteran of the cybersecurity and technology industries.”
asserted
CYPFER → announce → industries
He “has helped thousands of organizations of all sizes and industries recover from devastating cyberattacks and consulted to management boards, executives, legal counsel and insurance carriers on resilience and risk mitigation methodologies.”
asserted
thousands → help → methodologies
He left the company almost a year ago, according to his LinkedIn page.
uncertain
He → leave → page
A representative for the company could not be reached for comment.
uncertain
representative → reach → comment
Mr. Dubrovsky’s book, published last month, is about cyberextortion and strategies for managing a ransomware crisis.
asserted
book → publish → crisis
“I have negotiated with criminals who viewed themselves as martyrs ... even after deploying malware against critical infrastructure and causing billions of dollars in damage,” Mr. Dubrovsky wrote in his book.
asserted
Dubrovsky → negotiate → book
“We must understand our opponents if we expect to survive on the digital battleground, and we must understand them better if we hope to reach common ground in negotiations.”
asserted
we → understand → negotiations
The FBI’s advisory from May characterized ShinyHunters as “threat actors” who often “use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims,” commonly harass or threaten people, and “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.”
uncertain
which → characterize → victims
The ShinyHunters group has also attacked Canadian companies.
asserted
group → attack → companies
In March, Vancouver-based telecom company Telus Corp. said it was investigating a cybersecurity incident at a recently reacquired technology business line.
asserted
it → base → line
The matter involved unauthorized access by the hacking group.
asserted
matter → involve → group
According to technology news website BleepingComputer, ShinyHunters said it stole nearly one petabyte of data from Telus Digital, including customer data, in a multi-month breach.
uncertain
it → accord → breach
The group demanded a ransom in exchange for not leaking the data.
asserted
group → demand → data
The Aporia
