Skip to content 
Canadians in the cyber security world say they were shocked to hear that a prominent ransomware negotiator has been arrested by the FBI for suspected ties to criminal hacking group ShinyHunters.
FBI Director Kash Patel on Friday confirmed the arrest of a “suspected co-conspirator” in the recent ShinyHunters cyberattack on FBIjobs.gov that exposed a trove of sensitive data about FBI personnel.
“We will continue to work closely with our partners to disrupt what remains of the ShinyHunters group and their employees wherever they operate,” Patel said on social media.
Reuters reported on Sunday that sources familiar with the matter identified the arrested suspect as Ed Dubrovsky, a Canadian cybersecurity executive whose career has focused on helping clients negotiate with ransomware attackers.
Court documents from the US District Court for the Eastern District of Pennsylvania show that Dubrovsky faces two criminal charges: conspiracy to threaten the confidentiality of information with the intent to extort money, and interference with commerce by threats.
The allegations have not been proven in court.
FBI Director Kash Patel testifies during a Senate Judiciary hearing on oversight of the Federal Bureau of Investigation, in September 2026 in Washington. Patel confirmed the arrest of a suspected co-conspirator in the ShinyHunters investigation.(Manuel Balce Ceneta/Associated Press)
‘A sense of shock’
“For the cybersecurity community in general, I think there’s a sense of shock,” Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News on Monday.
Kotak says that Dubrovsky is “very popular” and has spoken at many conferences, but stresses that the allegations are “clearly just allegations” and that it is not yet known “what exactly happened.”
“This is an individual who was largely respected when it came to dealing with ransomware,” he said. “A lot of people are also familiar with his work.”
The court records, which are partially sealed, provide conflicting spellings of the suspect’s last name — “Dobrovsky” or “Dobrosky” — and do not identify his age, occupation or employer.
Jail records show that a 54-year-old Edward Dubrovsky is being held at a federal detention center in Philadelphia.
Reuters reports that electronic wallet records leaked in 2010 and maintained by the dark-web intelligence firm District 4 Labs identify Dubrovsky as a 54-year-old resident of Richmond Hill, a suburb of Toronto.
Long history in cyber security
Dubrovsky’s LinkedIn profile describes him as a specialist in ransom negotiations with cybercriminals, as well as a “globally recognized cybersecurity expert, business leader, speaker, author and educator”.
According to his profile, Dubrovsky has held senior positions in cybersecurity for decades.
He wrote on LinkedIn last month that he will attend the NetDilligence conference in Philadelphia in October with the cybersecurity company CyberSteward. The company posted photos of Dubrovsky at the conference a week ago and said he signed copies of a book he recently published on handling cyber extortion.
A new EY report says AI will become a major force behind cybercrime in 2026, as programs help attackers sharpen their scamming skills.
In the book’s introduction, Dubrovsky writes: “I have dealt with criminals who saw themselves as martyrs, criminal masters, and patriots of their own countries, even after deploying malware against critical infrastructure and causing billions of dollars in damage. Such people can still look in the mirror and see goodness.”
CBC News contacted CyberSteward by phone, email and in person at his Toronto address, but did not receive a response Monday.
The FBI’s national press office declined to comment immediately on Dubrovsky’s arrest and referred CBC News to Patel’s statement.
RCMP spokesman Ian Lordon told The Canadian Press on Friday that “the RCMP is aware of the arrest of a Canadian in the United States in connection with the ShinyHunters hack,” but directed all further questions to the FBI.
ShinyHunters poked the bear: Expert
ShinyHunters is known as one of the world’s strongest data theft and extortion groups, typically demanding ransom in exchange for not releasing the sensitive data it has received.
The hacking group caused chaos at universities around the world in May, including in Canada, with a cyberattack on Canvas, an online learning management system that connects millions of students with their instructors.
ShinyHunters has also been linked to high-profile cyberattacks involving companies including Telus, Microsoft, Ticketmaster, Pornhub and Rockstar Games.
Last month, the group claimed responsibility for stealing a massive trove of data from the FBI — including officials’ jobs, addresses and Social Security numbers — in what it said was retaliation for the law enforcement agency making false claims about the group.
ShinyHunters later told CBC News they would not release the data.
David Shipley, a cybersecurity expert and CEO of Fredericton-based Beauceron Security, said the stunt “poked the bear” and “literally unleashed the most powerful law enforcement agency in the world on them.”
The parent company behind Canvas, a widely used learning management platform that connects students with their schools or universities, has struck a deal with the hacking group that claims responsibility for last week’s massive cyber security breach.
Shipley said surprise was the first thing that came to mind when he heard of the latest arrest.
“I knew the ShinyHunters investigation would go to interesting places because it’s already the stuff of Hollywood movies,” he told CBC News.
“I don’t think anyone saw this twist coming.”
Shipley said Dubrovsky was well-regarded and worked for “top-tier” cybersecurity companies.
“I feel terrible for his former colleagues, both at his current company and at his previous companies, who have been dragged through these terrible headlines,” he said.
