Canadian cybersecurity executive charged with extortion offences

Court records say Edward Dubrovsky is charged with threatening to disclose stolen data and extortion

By LineZotpaper

Published20 October 2026

Read Time3 min

Canadian cybersecurity executive Edward Dubrovsky has been arrested by the FBI and charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records cited by KrebsOnSecurity. The arrest came during an investigation into the ShinyHunters hacking group after its breach of the FBI's recruitment website in September.

The ShinyHunters hacking group, which has claimed credit for dozens of major data breaches since 2019, recently came under intense scrutiny after breaching fbijobs.gov in late September. Stolen files reportedly included medical and psychological records, Social Security numbers, and information about employees' units and specializations. The hack prompted the FBI to move with unusual speed to arrest and question individuals connected to the group.

Reuters reported on October 3 that a person identified as the current leader of ShinyHunters had been detained by Jordanian authorities and was cooperating with the FBI. The person was reported to have taken control of the group after the arrest of one of its senior members.

On September 15, Dutch authorities detained Pepijn van der Stap, a convicted hacker and ShinyHunters suspect, KrebsOnSecurity reported.

On October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and author, on charges related to threatening to disclose stolen data and extortion. Court records show prosecutors have requested he remain in custody and that case records stay sealed.

Dubrovsky had previously published a book on handling cyber extortion that recommended always engaging with hackers. The Globe and Mail reported that months before his arrest, Dubrovsky filed a lawsuit in Ontario against former business partner Daniel Tobok, accusing him of trying to "destroy" another industry executive. Tobok denied the allegations and filed a counterclaim.

The FBI has declined to comment on the ongoing investigation.

Analysis

Why This Matters

The investigation reveals potential conflicts of interest within the ransomware negotiation industry, where consultants trusted by victims may have been aiding the criminals they were hired to negotiate with.
If proven, the allegations could lead to a crisis of confidence in the cyber incident response sector, with companies questioning the integrity of the firms they hire to handle extortion.
The case also underscores the growing sophistication of cybercrime investigations, where compromised accounts and messaging app data are used to map relationships between hackers and their enablers.

Background

ShinyHunters emerged around 2019 as a hacking group focused on data theft and extortion. Originally operated by cybercriminals based in France, the group saw its members arrested over time, with control eventually passing to a teenager in Jordan known as "Rey." The group has claimed responsibility for dozens of high-profile breaches and, according to the FBI, extorted more than $70 million from victims in 2026 alone. The arrest of Pepijn van der Stap in the Netherlands appears to have been a turning point, giving investigators access to Signal messages that linked ransomware negotiators directly to the group's operations.

Key Perspectives

Law enforcement: The FBI views the suspected collusion as a serious crime, moving quickly to detain and charge individuals who may have used their positions to facilitate extortion rather than help victims. Ransomware negotiation firms: The industry is built on trust and confidentiality. If executives acted improperly, it could tarnish the entire sector, though the vast majority of negotiators operate ethically. Critics: Some security professionals have long warned that hiring former hackers or people with ambiguous ties to the cybercrime world creates inherent risks. This case may strengthen calls for stricter regulation and background checks for incident response consultants.

What to Watch

Whether additional arrests are made, particularly of the unnamed U.S. consulting firm executive.
The outcome of Edward Dubrovsky's detention hearing and any evidence unsealed in the case.
How the ransomware negotiation industry responds with new ethical guidelines or oversight mechanisms.
The status of "Rey" and whether his cooperation leads to further breakthroughs in the investigation.

Sources

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site · Krebs on Security

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedCanadian cybersecurity executive charged with extortion offencesKrebs on Security: “was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records”
SupportedCourt records say Edward Dubrovsky is charged with threatening to disclose stolen data and extortionKrebs on Security: “was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records”
SupportedEdward Dubrovsky has been arrested by the FBI and charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortionKrebs on Security: “On October 9, KrebsOnSecurity broke the news that the FBI arrested ... Edward Dubrovsky ... charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion”
Not in the sourcesCourt records show prosecutors have requested he remain in custody and that case records stay sealedKrebs on Security: “Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records related to his case remain under seal”
Not in the sourcesThe FBI has declined to comment on the ongoing investigation
SupportedThe ShinyHunters hacking group has claimed credit for dozens of major data breaches since 2019, and recently breached fbijobs.gov in late SeptemberKrebs on Security: “Hackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019 ... In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov”
SupportedStolen files reportedly included medical and psychological records, Social Security numbers, and information about employees' units and specializationsKrebs on Security: “the stolen files, which reportedly included medical and psychological records, Social Security numbers and home addresses, and information about each employee’s unit and specialization”
SupportedThe hack prompted the FBI to move with unusual speed to arrest and question individuals connected to the groupKrebs on Security: “The FBI jobs site hack has prompted the agency to move with uncommon speed to arrest, detain and question people”
SupportedReuters reported on October 3 that a person identified as the current leader of ShinyHunters had been detained by Jordanian authorities and was cooperating with the FBIKrebs on Security: “Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI”
SupportedOn September 15, Dutch authorities detained Pepijn van der Stap, a convicted hacker and ShinyHunters suspect, KrebsOnSecurity reportedKrebs on Security: “On the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap”
SupportedOn October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and authorKrebs on Security: “On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky ... who recently published a book”
SupportedThe Globe and Mail reported that months before his arrest, Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, accusing him of trying to 'destroy' another industry executiveKrebs on Security: “the Canadian cybersecurity executive alleged in court documents he had become collateral damage in a campaign by a former business partner to 'destroy' another industry executive”