BREACH WATCH BRIEF High 💀 Threat intel

FBI Arrests Co‑Founder of Ransomware Negotiation Firm Tied to ShinyHunters Extortion Scheme

The FBI detained Edward Dubrovsky, co‑founder of a Canadian ransomware‑negotiation firm, on extortion and conspiracy charges linked to the ShinyHunters group. The incident underscores the need for continuous vendor oversight and audit‑ready evidence of third‑party risk controls.

ADTP Breach Watch · October 10, 2026 · Krebs on Security

SeverityHigh

Type💀 Threat intel

ConfidenceHigh

ReportedOct 10, 2026

Technology & SaaS Enterprises that engage external ransomware‑negotiation services Cyber‑risk consultancies and insurance providers Third-Party Dependency

Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.

What happened

Federal agents arrested Edward Dubrovsky, co‑founder of Cypher (now associated with CyberSteward), on suspicion of assisting the ShinyHunters hacking group. The sealed complaint alleges conspiracy to threaten confidentiality of information to extort money and interference with commerce. The arrest followed his attendance at a cyber‑insurance conference in Pennsylvania.

Why it matters for trust and compliance

This case demonstrates why a continuous third‑party risk‑management program is essential: it provides the evidence trail needed to prove due‑diligence and control effectiveness when a supplier is implicated in illicit activity.
Maintain auditable records of vendor vetting, contract terms, and ongoing monitoring.
Implement continuous alerts for law‑enforcement actions or negative media involving critical suppliers.

Who is affected

Enterprises that engage external ransomware‑negotiation services Cyber‑risk consultancies and insurance providers

Recommended actions

Audit existing contracts with negotiation firms for compliance clauses and termination rights.
Add real‑time monitoring of vendor reputational signals (e.g., legal filings, sanctions) to your risk platform.

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.