Canadian ransomware negotiator arrested in FBI hacking case

PHILADELPHIA — A Canadian cybersecurity executive who specialized in negotiating ransomware payments has been arrested in the United States in connection with the ShinyHunters hacking group's breach of FBI data.

FBI Director Kash Patel confirmed the arrest of a "suspected co-conspirator" on social media Friday.

"We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," Patel said.

READ MORE: U.S. resident charged with aiding Tumbler Ridge shooter in alleged months-long conspiracy

READ MORE: Lethbridge teen charged with terrorism, child sexual abuse and animal cruelty

Reuters reported the arrested suspect is Ed Dubrovsky, a 54-year-old from Richmond Hill, Ont.

Court documents from the U.S. District Court for the Eastern District of Pennsylvania show Dubrovsky is facing two criminal charges: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats.

The allegations have not been proven in court.

"For the cybersecurity community in general, I think that there's a sense of shock," Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News.

Kotak said Dubrovsky is "very popular" and respected in ransomware negotiations.

Prison records show a 54-year-old named Edward Dubrovsky is being held at a federal detention centre in Philadelphia.

His LinkedIn profile describes him as a specialist in negotiating with cybercriminals over ransom payments and a "globally recognized cybersecurity expert, business leader, speaker, author and educator."

He wrote on LinkedIn last month that he would be attending the NetDilligence conference in Philadelphia in October with cybersecurity firm CyberSteward.

CBC News reached out to CyberSteward but did not get a response Monday.

The FBI's national press office declined to comment directly on Dubrovsky's arrest and referred CBC News to Patel's statement.

RCMP spokesperson Ian Lordon said Friday that "the RCMP is aware of the arrest of a Canadian in the U.S. in connection with the ShinyHunters hack," but directed all further questions to the FBI.

ShinyHunters is known as one of the world's most prolific data theft and extortion groups.

Last month, the group claimed responsibility for stealing a massive trove of data from the FBI, including officials' job assignments, addresses and social security numbers, in what it said was retaliation for the law enforcement agency making false claims about the group.

David Shipley, a cybersecurity expert and CEO of Fredericton-based Beauceron Security, said surprise was the first thing that came to mind when he heard of the latest arrest.

"I knew the ShinyHunters investigation was going to go in interesting places because it's already the stuff of Hollywood movies," he told CBC News.

Shipley said Dubrovsky was well regarded and worked for "top-tier" cybersecurity firms.

"I feel terrible for his former colleagues, both at his current firm and his past firms, who have been dragged through these awful headlines," he said.

According to his LinkedIn profile, Dubrovsky has held senior positions in cybersecurity for decades.

His most recent permanent post was at CYPFER, a global cybersecurity firm.

In a 2022 press release announcing his appointment as managing director, CYPFER described him as a "30-year veteran of the cybersecurity and technology industries" who "has helped thousands of organizations of all sizes and industries recover from devastating cyberattacks."

He left the company almost a year ago, according to his LinkedIn page.

Dubrovsky recently published a book about handling cyber extortion.

"I have negotiated with criminals who viewed themselves as martyrs, criminal masterminds, and patriots of their own countries even after deploying malware against critical infrastructure and causing billions of dollars in damage," Dubrovsky wrote in the book's introduction.

ShinyHunters has also been associated with high-profile cyberattacks affecting companies including Telus, Microsoft, Ticketmaster, Pornhub and Rockstar Games.

With files from The Canadian Press, CBC News and The Globe and Mail