Edward Dubrovsky, 54, a Canadian co-founder of the ransomware negotiation firm CYPFER, was arrested by the FBI on October 9 in an extortion case that has been tied to the ShinyHunters investigation. The FBI has not formally named him or confirmed the link, and the complaint is sealed.
Arrest in Pennsylvania at a Cybersecurity Conference
Dubrovsky was arrested in Pennsylvania while attending a cybersecurity conference. The case was filed in the Eastern District of Texas, and public reporting followed on October 10. A detention hearing is pending.
Neither Dubrovsky nor CYPFER has commented.
Conspiracy and Hobbs Act Extortion Counts on the Docket
The docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort, citing 18 USC 371 and 1030(a)(7)(B). It also lists Hobbs Act extortion under 18 USC 1951. The complaint itself is sealed, so details of the allegations are not public.
The ShinyHunters Connection Is Not Confirmed
FBI Director Kash Patel posted that another suspected ShinyHunters co-conspirator had been arrested. The FBI has not formally named Dubrovsky or confirmed that the post refers to him.
The FBI IT Systems Attack Referenced in Reporting
One report ties the arrest to the ShinyHunters attack on FBI IT systems. That attack exposed the data of thousands of FBI employees through an unpatched third-party platform used by an Accenture contractor. The link between that attack and Dubrovsky’s case comes from that report and is not confirmed by the FBI.
Trust in Ransomware Negotiation Firms Questioned
The arrest raises questions about trust in ransomware negotiation firms, which handle sensitive communications between victims and extortionists. CYPFER is described as a ransomware negotiation firm, and Dubrovsky is its co-founder.
The case is a new development in an already reported ShinyHunters saga rather than a repeat of earlier coverage.
Several elements remain unknown. The sealed complaint means the specific conduct alleged against Dubrovsky is not public. The charges as listed, which concern threats to impair the confidentiality of information with intent to extort, describe a data-extortion theory of the case, but the docket alone does not say who the alleged victims were or what role he is accused of playing.
The detention hearing, which is pending, is the next scheduled step and may bring out more detail about the government’s allegations. Until then, the account rests on the docket entries, Patel’s post about another suspected co-conspirator, and press reporting connecting the arrest to the ShinyHunters investigation, with the FBI declining so far to confirm that connection.
What CYPFER Does and Why the Case Draws Attention
CYPFER is a ransomware negotiation firm, and Dubrovsky is one of its co-founders. Firms of this type sit between victims and extortionists during an attack. An arrest of a co-founder on extortion-related charges is therefore unusual and has prompted questions about trust in the sector, according to the reporting.
Charges, Venue and Patel’s Post: What Is Established
The reporting is careful about what is established. The docket lists the charges and the venue. Patel’s post refers to an arrest of a suspected ShinyHunters co-conspirator without a name. The FBI has not tied the two together formally. One report’s link to the ShinyHunters attack on FBI IT systems, involving an unpatched third-party platform used by an Accenture contractor, is the reporting’s own connection.
The charges also span two different statutes in the same case. Section 371 covers conspiracy, and Section 1030(a)(7)(B) addresses threats to impair the confidentiality of information with intent to extort, while the separate Hobbs Act count under Section 1951 addresses extortion directly. Together they describe a case built around threats and extortion, though the sealed complaint keeps the underlying facts out of public view.
