Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major, high-impact data breaches dating back to 2019. During its initial years, the collective was primarily operated by cybercriminals residing in France. However, as those founding members were systematically arrested, extradited, and jailed by international law enforcement agencies, operational control over the ShinyHunters brand eventually shifted to a teenage hacker from Amman, Jordan, known online as "Rey," who was identified by authorities late last year. According to estimates provided by the FBI, the syndicate has successfully extorted more than $70 million from corporate and public sector victims globally over the course of the year.
The group’s brazen operations reached a critical inflection point in late September, when hackers tied to ShinyHunters breached the FBI recruitment website, fbijobs.gov. The attackers aggressively taunted federal law enforcement by threatening to publish a cache of deeply sensitive stolen files. Reports indicate that the compromised data included confidential medical and psychological records, Social Security numbers, home addresses, and granular details regarding the specific organizational units and specializations of FBI personnel.
The direct assault on an internal federal recruitment portal prompted the Bureau to move with uncommon swiftness, arresting, detaining, and questioning individuals worldwide who maintained any digital communications with Rey or other key ShinyHunters suspects. On October 3, Reuters reported that Rey had been captured by Jordanian authorities and was actively cooperating with federal investigators.
Rey had successfully assumed administrative control over the hacking group because one of its primary senior members had been abruptly neutralized just weeks prior. On the evening of September 15, law enforcement officers in the Netherlands executed a high-risk tactical raid, deploying flash-bang grenades to stun and apprehend convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap as he remained actively logged into multiple online accounts.
According to sources close to the investigation, Dutch authorities managed to seize Van der Stap while he was actively communicating via his Signal instant messaging account. This tactical advantage granted investigators real-time access to recent conversations with his most frequent contacts, including ransomware negotiators operating out of Canada and the United States.
Multiple knowledgeable sources confirmed to KrebsOnSecurity that Van der Stap’s decrypted Signal messages served as the crucial linchpin for unraveling an alarming murder-for-hire plot that surfaced immediately in the wake of his arrest. Dutch news outlet RTL reported last month that two targeted murders were allegedly scheduled to be executed abroad, with mounting indications pointing toward Van der Stap as the individual who issued the orders, though authorities noted there is no evidence indicating the violent plots were ultimately carried out.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky in connection with the escalating ShinyHunters investigation. Dubrovsky, who recently authored a published book on handling cyber extortion that advised victims to consistently maintain open channels of engagement with hackers, was formally charged in court records with threatening to disclose compromised data and interfering with interstate commerce through extortion. Politico reported that federal prosecutors requested Dubrovsky remain held in custody pending trial, while records pertaining to his criminal case remain heavily sealed.
A source close to the investigation revealed that Van der Stap’s recovered Signal communications demonstrated frequent, direct conversations between the Dutch hacker and both Dubrovsky and an unidentified executive at a major U.S.-based consulting firm. These messages reportedly revealed that these corporate negotiators routinely possessed insider knowledge regarding fresh ShinyHunters victims well before the targeted organizations themselves had even discovered or acknowledged the security breaches.
Furthermore, investigators uncovered what they described as a potentially explosive detail: the chat logs showed that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data directly from core FBI servers. Despite this profound knowledge, Dubrovsky never alerted the Bureau to the breach prior to the criminal group publicly utilizing Twitter and X to threaten the release of deeply personal employee records.
SHINYWIRE
Federal investigators probing the network believe that at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating the now-defunct ShinyHunters victim extortion portal, known as "shinywire[.]com." While KrebsOnSecurity has chosen to withhold the names of the U.S. company and the suspected executive pending formal criminal charges, the enterprise is recognized as a prestigious professional services firm employing more than 1,000 associates.
The Shinywire website remained actively operational from approximately May 3, 2026, until October 16, cataloging nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each targeted entry explicitly urged victims to engage directly with the cybercrime syndicate to negotiate financial terms. The web pages also featured concrete samples of the stolen files, accompanied by explicit warnings that the full data caches would be published openly on the internet if the victim failed to comply with ransom demands.
Cached records of the site illustrate extortion demands targeting entities such as Intuitive Surgical, an American medical technology corporation that suffered a security breach in March 2026 after an employee fell victim to a targeted phishing campaign that compromised credential access. Organizations that refused to negotiate within a strict seven-day window ultimately found their proprietary and customer data published indiscriminately on the main ShinyHunters shaming blog, which is accessible solely through the Tor anonymity network.
In mid-October, The Globe and Mail reported that months prior to his arrest by the FBI, Edward Dubrovsky had filed a civil lawsuit in Ontario alleging he had become unintended collateral damage in an aggressive campaign waged by a former business partner seeking to ruin another industry executive. The legal filings targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
Dubrovsky and Tobok initially partnered in 2017 to build Cypfer, where Dubrovsky served as a managing partner and chief operating officer. However, by 2024, their relationship deteriorated significantly, with Dubrovsky alleging in court documents that Tobok progressively marginalized him from corporate decisions and implemented increasingly erratic business strategies. Tobok strongly denied the allegations, filing a countersuit accusing Dubrovsky of misappropriating confidential corporate data and engaging in unfair competition via another venture named CyberSteward Inc., while asserting that Dubrovsky was never a foundational shareholder.
GHOSTBYTE
According to interviews conducted with former colleagues, long before these corporate legal disputes emerged, Tobok was known within ransomware circles by a specific moniker: Ghostbyte. In 2018, a Canadian enterprise fell victim to Dharma, a prolific Russian-language ransomware affiliate program initially launched in 2016. When the victim informed the Dharma extortionist that they were inclined to pay because crucial encrypted files were permanently unrecoverable, they requested stronger guarantees that the hackers would honor their word upon payment.
A redacted copy of the Dharma representative’s email response advised the victim to contact an IT professional in Canada who specialized in resolving such crises. The hacker specifically directed the target to communicate via the email address [email protected], noting that the firm regularly handled such negotiations locally.
While it remains unconfirmed whether Tobok directly utilized the Ghostbyte email address provided by the Dharma affiliate, and despite Tobok failing to respond to repeated requests for comment, breach tracking firm Constella Intelligence discovered that an email address frequently used by Tobok—[email protected]—was tied to multiple online accounts utilizing the handle "ghostbyte," including a Snapchat profile. Furthermore, Constella established that the Dharma representative’s fallback email address was linked to a cryptocurrency wallet that had processed dozens of transactions totaling significant digital assets.
In formal statements addressing the unfolding scandal, Cypfer maintained that its corporate services do not encompass making or facilitating ransomware payments, and emphasized that the company learned of Dubrovsky’s federal arrest exclusively through news media reports. Representatives asserted that Cypfer had received no outreach from law enforcement agencies and was not the target of any ongoing investigation. The statement noted that Cypfer and CyberSteward operate as completely distinct corporate entities with zero overlapping officers or directors, and highlighted Cypfer’s recent acquisition by the Apros Group, a holding enterprise led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
Under United States federal law, paying cybercriminals for a decryption key to restore locked systems or securing a promise to delete stolen files is not inherently illegal. Legal complications typically arise only if an organization transmits funds to a ransomware group currently designated under official sanctions by the U.S. Treasury Department, a restriction that has not historically applied to the core ShinyHunters collective.
Industry experts observe that corporate victims are frequently directed by cyber insurance providers to engage specific incident response firms. However, because specialized forensic and breach response companies vary widely in their willingness to facilitate direct extortion payments, clients often cycle through multiple vendors until they find a firm willing to process the transaction.
A prominent example occurred in December 2024, when ShinyHunters targeted educational technology firm PowerSchool, successfully exfiltrating private data belonging to millions of students and educators across North America. PowerSchool ultimately paid a reported $2.85 million ransom, aided by the firm CyberSteward, though subsequent criminal prosecutions resulted in prison sentences for affiliated actors. Despite the payment, the security compromise continued to reverberate as individual school districts received separate extortion demands using identical stolen files, underscoring the reality that ransom payments offer no technical guarantee of data deletion.
Leading incident response organizations, including Coveware and Unit 221B, have consistently warned victims against paying ransom demands to groups like ShinyHunters, pointing out that exfiltrated data is frequently retained, resold, or leveraged for secondary extortion campaigns. The FBI reinforced this guidance in an official public service announcement warning against compliance.
Internal communications recovered by investigators demonstrate the extent to which these warnings disrupted the hackers’ business model. Private Telegram chats from May 2026 show ShinyHunters leadership venting frustration that Coveware’s public advisories were severely harming their monetization rates and driving down compliance among targeted companies.
Mark Camillo, chief executive of CyberAcuView—an industry consortium established by major cyber insurance carriers—pointed out an inherent conflict of interest embedded within the incident response ecosystem. While some firms operate on flat retainer fees, others structure their compensation as a direct percentage of the total ransom paid. Camillo noted that percentage-based models create a perverse financial incentive for negotiators to maximize payouts rather than aggressively negotiate reductions.
The Department of Justice has increasingly targeted these structural conflicts through direct criminal prosecutions. In October, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients millions for remediation while secretly paying out lesser sums to hackers behind their backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to prison time for conspiring with the Blackcat/ALPHV ransomware syndicate to extort victims by feeding confidential negotiation strategies directly to the threat actors.
