Back Darkreading

Prominent Ransomware Negotiator Faces Extortion Charges

Darkreading • October 12, 2026

Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.

US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest example of cybersecurity professionals being implicated in the very activity they're supposed to defend against.

Edward Dubrovsky, 54, was charged for conspiracy to threaten to impair the confidentiality of information with the intent to extort money, under 18 U.S.C. § 1030(a)(7)(B), a federal provision of the Computer Fraud and Abuse Act (CFAA).

While the exact context of the charge remains unclear, as the main complaint is still sealed, what is particularly notable this case is Dubrovsky's prominence within the security community as both an executive and an established ransomware negotiator. Prior to these charges, he regularly shared his expertise with various publications, including Dark Reading . He also recently self-published a strategic guidebook discussing best practices for responding to cyber-extortion attempts.

Related: Is It Fair to Blame 'Rogue' AI for Security Failures?

Based in Canada, Dubrovsky is associated with a number of cybersecurity firms. He previously was an executive at Cypfer, an incident response firm, from 2022 until the end of 2025, and is a member of the advisory board at FileFlex, a zero-trust product vendor. He also recently attended a cybersecurity conference in Philadelphia with a firm he said he currently works with, cybersecurity advisory firm CyberSteward.

Dark Reading reached out to Cypfer, CyberSteward, and FileFlex parent company Qnext for , but none responded by press time.

Possible ShinyHunters Connection

None of the publicly available documents involving Dubrovsky tie his arrest to a specific incident. However, FBI Director Kash Patel said in a post to X Friday that the bureau "arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor."

While Patel did not identify the suspect, several factors suggest Dubrovsky may be the individual referenced in the post. A Philadelphia judge sent Dubrovsky's case to Texas , where a source told KrebsOnSecurity recent ShinyHunters investigations are centralized. Furthermore, The New York Times on Friday reported that the FBI arrested a Canadian man in Pennsylvania suspected of working with ShinyHunters.

ShinyHunters is a loose collective of threat actors known for data extortion attacks. The group previously was behind a number of highly visible threat campaigns involving compromised Salesforce instances and attacks on higher education institutions .

Related: Red Flags That Expose Fake North Korean IT Workers

But perhaps most notably, ShinyHunters last month hacked a third-party jobs site used by the FBI . The group further claimed they stole data belonging to nearly every FBI employee and job applicant. In response, the FBI has aggressively pursued ShinyHunters, making a number of arrests in the process.

Other Legal Issues in the Ransomware Negotiation Industry

Dubrovsky is not the first ransomware negotiator charged in connection with his work. Last week, Zohar Pinhasi was arraigned by the US Attorney's Office for the Eastern District of New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company, MonsterCloud. Pinhasi was accused of promising clients that he could decrypt ransomware without paying criminals, only to then pay criminals himself and charge the end customer a substantial markup.

In another case, a ransomware negotiator, Angelo Martino, was convicted for sharing details with the BlackCat ransomware group in exchange for payment.

Jeff Wichman, Semperis senior director of breach preparedness and response, tells Dark Reading these incidents may impact the incident response industry to some degree going forward.

"I think these incidents are likely to put additional pressure on ransomware negotiation firms to strengthen their background check processes," he says. "These firms will likely also face greater scrutiny from the insurance industry, including the insurers that back ransomware negotiation firms."

Related: Ransomware Negotiator Pleads Guilty to BlackCat Scheme

Court records indicate Dubrovsky was represented by the Federal Defenders office during his initial appearance. Dark Reading could not reach Dubrovsky for .

Senior News Writer, Dark Reading

Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Security, Nintendo World Report, and elsewhere.

At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.

He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

How to Harness your Security Operations Data for Enterprise Defense

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development

Effective Alert Triage: Reducing Noise and Finding Real Threats

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Negotiator Arrested Amid ShinyHunters Investigation Edward Dubrovsky, a prominent ransomware negotiator, was arrested in Pennsylvania on charges of conspiracy to extort money, under the Computer Fraud and Abuse Act. The specifics of the case remain sealed, but it is linked to the ShinyHunters group, known for data extortion attacks. FBI Director Kash Patel indicated that the arrest is part of ongoing investigations into ShinyHunters, which has been implicated in high-profile cyber incidents, including a recent breach affecting FBI job applicants. Dubrovsky's arrest raises concerns about the integrity of cybersecurity professionals and their involvement in criminal activities. He had previously worked with various cybersecurity firms and authored a guide on responding to cyber-extortion. The investigation is ongoing, with further details expected as the case unfolds. 2 sources 37

Extracted Entities

Prominent Ransomware Negotiator Faces Extortion Charges

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Countries (1)

Domains (1)

MITRE ATT&CK (1)

Ransomware Groups (1)