According to multiple sources familiar with the matter, the arrest took place in Pennsylvania, where Dubrovsky was visiting to attend a prominent cyber insurance gathering known as the Cyber Risk Summit. The federal dragnet highlights a dramatic escalation in the Department of Justice’s efforts to dismantle the infrastructure behind ShinyHunters, a cybercrime syndicate that has reportedly extorted more than $70 million from corporate and government victims so far this year alone.
The New York Times first reported the arrest of a Canadian man in Pennsylvania on suspicion of providing assistance to the ShinyHunters operation. While the initial reports and a public statement posted to social media by FBI Director Kash Patel did not explicitly name the suspect, sources close to the ongoing investigation confirmed his identity to security journalist Brian Krebs. Further corroboration emerged from federal court documents and conference speaker rosters linking Dubrovsky directly to the events unfolding in Pennsylvania.
Sources indicated that Dubrovsky’s professional background made him a prominent figure in the niche sector of cyber extortion response. His company specialized in handling complex ransomware negotiations on behalf of victimized organizations, a role that puts security professionals in direct, delicate communication with dangerous cybercriminal organizations. Control over the multi-jurisdictional ShinyHunters investigation has reportedly been centralized at an FBI field office in Texas, marking a significant strategic pivot for federal prosecutors.
Online public records and event disclosures reveal that the Cyber Risk Summit was hosted at the Loews Philadelphia Hotel. While the annual conference featured numerous corporate sponsors, summit documentation indicates that the single largest sponsor was Cypfer, the Canadian security firm co-founded by Dubrovsky.
According to professional networking profiles, Dubrovsky transitioned his work to another Canadian security firm and conference sponsor known as CyberSteward. Approximately one month prior to his arrest, Dubrovsky published a post on LinkedIn announcing his travel plans to attend the Philadelphia summit alongside his new team members. In that post, he emphasized his ongoing involvement in high-stakes negotiations and advisory services. "Looking forward to continuing conversations around strategy & compliant driven coercive advisory, negotiations and settlement services that are global and truly agnostic," Dubrovsky wrote at the time.
Federal court records show that on October 8, an individual named Edward Dobrovsky—with a slight misspelling of the last name—was taken into custody in Pennsylvania on serious federal charges including cyber extortion and conspiracy. While several core documents, including the primary criminal complaint, have been placed under seal by the court, a handful of filings remain accessible through public legal archives such as CourtListener. An indexed summary of the complaint charges the defendant with "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats."
Inmate locator records maintained by the U.S. Bureau of Prisons confirmed that a 54-year-old individual matching Dubrovsky’s description was initially held at a federal detention facility in Philadelphia. However, subsequent court notifications filed on October 9 indicate that the legal proceedings have been officially transferred to the U.S. District Court for the Eastern District of Texas, aligning with intelligence that the district has become the epicenter of the government’s comprehensive ShinyHunters probe. The FBI has consistently declined to comment on the ongoing court case.
Beyond his executive career in incident response, Dubrovsky is the author of Cyber Extortion Strategic Response, a 252-page textbook designed to guide organizations through the chaotic aftermath of a major digital ransom demand. The book’s commercial descriptions heavily emphasize the fine distinctions required when dealing with digital extortionists. An excerpt from the book’s listing articulates a core philosophy of modern negotiation: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay. The text argues that active engagement can serve other vital objectives, including testing hackers’ claims, gathering forensic intelligence, buying critical time, and preserving operational options while leadership evaluates its next steps.
At the time of reporting, Dubrovsky could not be reached for direct comment regarding the charges against him. Inquiries directed to his co-founder at CyberSteward went unanswered, and available court records demonstrate that he has not yet retained private legal counsel or been formally assigned a public defender by the presiding magistrate.
The broader investigation into ShinyHunters continues to uncover a web of international digital operatives and facilitators. The collective is well-known within the cybersecurity community for utilizing sophisticated phishing campaigns and stolen corporate credentials to siphon proprietary data from cloud-based software-as-a-service providers. Once the data is secured, the group threatens to leak it publicly unless massive cryptocurrency ransoms are satisfied.
Investigators have spent weeks meticulously reviewing digital devices seized during a late-September raid executed by Dutch law enforcement. That operation resulted in the arrest of Pepijn van der Stap, a convicted cybercriminal whose detention provided a major breakthrough in the wider ShinyHunters case. Federal authorities are reportedly scrutinizing the actions of other professionals and firms operating within the specialized ransomware negotiation space, and additional charges against corporate principals may be forthcoming.
The pressure on federal law enforcement intensified dramatically in the wake of Van der Stap’s arrest. A prominent member of the hacking collective operating under the pseudonym "Rey" seized control of the group’s public channels and began openly taunting the FBI. The taunts stemmed from a brazen breach that compromised the bureau’s online recruitment portal, exposing sensitive records detailing individual agents’ specialized units, operational backgrounds, and confidential medical and psychiatric evaluations.
Investigative reporting by Reuters revealed that the hacker known as Rey is actually a teenager named Saif Al-din Khader. Khader was subsequently detained by authorities and is reportedly cooperating with federal investigators. Background details published by security researchers highlighted that Khader’s apprehension occurred just as the collective was attempting an extortion campaign against a digital aviation and navigation unit that had been divested by Boeing in late 2025. As federal prosecutors untangle the complex network connecting hackers, facilitators, and negotiators, the investigation remains exceptionally fluid, with further legal developments anticipated.
