Canadian ransomware negotiator arrested in FBI hacking investigation
Ed Dubrovsky, a prominent cybersecurity executive, faces U.S. charges of conspiracy and interference with commerce by threats.
PHILADELPHIA · A Canadian cybersecurity executive who specialized in ransomware negotiations has been arrested in the United States on charges connected to the ShinyHunters hacking group. FBI Director Kash Patel announced the arrest of a suspected co-conspirator on Friday, following the group's theft of sensitive FBI employee data earlier this year. Court documents from Pennsylvania show the suspect, identified by sources as Edward Dubrovsky, faces charges of conspiracy to threaten to impair data confidentiality to extort money and interference with commerce by threats. The allegations contained in the filings have not been proven in court.
Prison records indicate a 54-year-old man named Edward Dubrovsky is detained at a federal facility in Philadelphia. The court documents, which are partially sealed, contain inconsistent spellings of his surname and do not list his occupation or employer. According to Reuters, electronic wallet records from a 2010 leak identify Dubrovsky as a 54-year-old resident of Richmond Hill, Ont., a Toronto suburb. The RCMP confirmed it is aware of the arrest of a Canadian in connection with the ShinyHunters hack but referred further questions to the FBI.
Ritesh Kotak, a Toronto-based technology and cybersecurity analyst, said the news has shocked the professional community. "For the cybersecurity community in general, I think that there's a sense of shock," Kotak told CBC News. He described Dubrovsky as very popular and a frequent conference speaker, while emphasizing the charges remain unproven allegations. "This is an individual that was for the most part respected when it came to ransomware negotiations," Kotak said. "A lot of people are familiar with his work as well."
READ MORE: Two Burnaby residents charged in homicide of missing 11-year-old boy
On social media, FBI Director Patel stated the arrest was part of a series of recent actions against the ShinyHunters network. "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," Patel said. The FBI's national press office declined to comment further, referring to Patel's statement. ShinyHunters claimed responsibility for hacking an FBI database in September, saying it was retaliation for false claims the bureau made about the group.
Dubrovsky's online professional profile lists him as an expert in negotiating with cybercriminals for ransom payments and a recognized cybersecurity leader, speaker and author. His career includes decades in senior cybersecurity roles. Last month, he posted on LinkedIn about attending the NetDilligence conference in Philadelphia with the firm CyberSteward, which shared photos of him signing copies of his new book there. The book is about managing cyber extortion, and in its introduction he writes, "I have negotiated with criminals who viewed themselves as martyrs, criminal masterminds, and patriots of their own countries even after deploying malware against critical infrastructure and causing billions of dollars in damage."
Cybersecurity expert David Shipley said his initial reaction to the arrest was surprise. "I knew the ShinyHunters investigation was going to go in interesting places because it's already the stuff of Hollywood movies," Shipley told CBC News. He said Dubrovsky was well regarded and had worked for top-tier firms. "I feel terrible for his former colleagues, both at his current firm and his past firms, who have been dragged through these awful headlines," Shipley said. Attempts to reach CyberSteward and Dubrovsky's former employer CYPFER for comment were unsuccessful. The ShinyHunters group is a prolific data theft and extortion collective known for demanding ransoms. It has been linked to attacks on numerous organizations, including Canadian telecom company Telus, Microsoft, Ticketmaster and an online learning platform used by universities worldwide. The FBI has characterized the group's members as threat actors who often harass victims and make exaggerated claims about accessing sensitive information to extort payments.
With files from The Canadian Press, CBC News and The Globe and Mail