Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania and transferred to the Eastern District of Texas, where a sealed complaint lists conspiracy and extortion charges. BleepingComputer reported the arrest on 10 October 2026. He remains in custody.
What happened
Dubrovsky co-founded CYPFER and has been associated with CyberSteward, firms that help breach and ransomware victims negotiate and send extortion payments. He was in Pennsylvania for the NetDiligence Cyber Risk Summit when agents took him into custody.
The docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort money, plus Hobbs Act extortion and conspiracy. The complaint itself is sealed, so the specific acts are not public.
FBI Director Kash Patel said agents had arrested another suspected ShinyHunters co-conspirator. The New York Times described a Canadian citizen arrested in Pennsylvania. KrebsOnSecurity and Politico identified Dubrovsky, and Krebs said multiple sources tied the arrest to the ShinyHunters investigation. The FBI has not publicly confirmed that he is that suspect.
Who is affected
- Organisations that used CYPFER or CyberSteward to negotiate or pay an extortion demand should ask counsel what the sealed case means for those engagements.
- Victims of ShinyHunters-style SaaS and cloud data theft, a cluster the FBI says breached more than 140 organisations and collected more than 70 million dollars in the past year.
- Any firm that treats a negotiator as a black box. This case is a reminder to know who is talking to the criminals and on what authority.
What to do now
Do not assume a negotiator engagement is clean just because the invoice was paid. If a client used these firms, preserve the engagement records and payment trail, and route questions through legal rather than the incident Slack channel.
Source: BleepingComputer, 10 October 2026, citing court records, Politico, and KrebsOnSecurity. Read the report.
Also on the blog
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Nippon Columbia malware exposed 8.63 million karaoke records
- FortiBleed still holds 86,644 Fortinet device credentials
- Fake Claude ads hide a ClickFix command behind Bing
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.