Key points
- An executive from a U.S. consulting firm allegedly helped run the ShinyHunters extortion website.
- Canadian executive Edward Dubrovsky was arrested and charged with extortion and threatening to disclose stolen data.
- Negotiators reportedly knew about breaches before the targeted organizations were aware they had been compromised.
Federal investigators identified potential connections between the ShinyHunters ransomware group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. This discovery raises serious concerns about how trusted intermediaries might facilitate criminal operations.
The inquiry intensified after authorities arrested suspected ShinyHunters member Pepijn van der Stap in the Netherlands on September 15. Investigators accessed his Signal account and reviewed communications with contacts in Canada and the United States, revealing frequent coordination with ransomware negotiators.
Operational Links and Arrests
Sources told KrebsOnSecurity that messages showed Edward Dubrovsky, a Canadian cybersecurity executive, communicated regularly with ShinyHunters members. Dubrovsky was subsequently arrested and charged with interfering with interstate commerce through extortion and threatening to disclose stolen information. Prosecutors have sought to keep him detained while related records remain sealed.
One source claimed Dubrovsky knew about stolen FBI information before the group publicly threatened to release it. He allegedly failed to notify the bureau in advance. These charges are allegations, not findings of guilt, but they highlight the depth of the alleged collaboration.
Exposure Through Negotiation Firms
An executive from an unnamed U.S. consulting company with over 1,000 associates allegedly assisted in operating the group’s victim extortion website. The site, shinywire.com, was active from May 3 to October 16, 2026. It listed nearly 100 organizations targeted by ShinyHunters.
The website combined samples of stolen data with demands for payment. Organizations that did not respond within seven days risked having their datasets published on the group’s Tor-accessible leak blog. The U.S. firm’s identity is withheld because authorities have not charged the suspected executive.
Next steps
Authorities continue to investigate the extent of the collaboration between the hacking group and the negotiation firms. No new fixes or patches are relevant to this specific investigative development, as it involves human actors rather than software vulnerabilities. Organizations should await further legal developments and official statements from law enforcement regarding any additional arrests or charges.
Signals worth monitoring
Security teams should monitor for unusual outbound communications from incident response or negotiation channels to unknown external parties. Check whether third-party vendors have access to sensitive breach data before official disclosure. Look for early knowledge of compromises in vendor communications that precedes internal detection. Isolate systems showing signs of unauthorized data exfiltration immediately. Verify the integrity of all communication logs with external consultants. Ensure that no single vendor has unchecked access to critical incident data.
Background: Ransomware
Ransomware protection combines network segmentation, strict least-privilege access, and immutable backups to prevent encryption malware from spreading. You must detect initial access vectors like phishing or unpatched services, isolate infected systems immediately, and restore data from offline copies that attackers cannot modify or delete.
Read the full guide: What Is Ransomware Protection: How to Stop Encryption Attacks
What to do and how to stay safe: ShinyHunters
- Review access logs for third-party negotiation firms to ensure they only receive data necessary for their role.
- Monitor outbound traffic from incident response tools for connections to unexpected external IP addresses or domains.
- Verify that all communications with external vendors are encrypted and logged for later forensic analysis.
- Conduct a threat hunt for indicators of compromise associated with ShinyHunters in your environment.
Step-by-step guide: Immutable Backups: Best Practices for Ransomware Resilience
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who was arrested in connection with ShinyHunters?
Pepijn van der Stap was arrested in the Netherlands, and Edward Dubrovsky was arrested in Canada and charged with extortion.
What did the U.S. consulting executive allegedly do?
The executive allegedly helped operate shinywire.com, an extortion website that listed targeted organizations and stolen data samples.
Did negotiators know about breaches before victims?
Yes, sources indicated that negotiators knew details about some ShinyHunters victims before those organizations knew they had been breached.
