"Go on my website, majority of those companies would've paid if it weren't for Coveware giving them misinformation," the ShinyHunters account wrote, according to screenshots shared with KrebsOnSecurity.
Pepijn van der Stap’s arrest and the Signal thread that changed the probe
On the evening of September 15, 2026, Dutch authorities arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly used flash‑bang grenades while he was logged into online accounts; a source close to the investigation told KrebsOnSecurity that authorities captured van der Stap's Signal messages. Those messages, investigators say, revealed frequent communications with ransomware negotiators in Canada and the United States and became “the key” to unraveling additional plots and relationships tied to ShinyHunters, including a murder‑for‑hire scheme reported by RTL that allegedly originated in the wake of his arrest.
Edward Dubrovsky charged; alleged ties to stolen FBI data
On October 9, the FBI arrested 54‑year‑old Canadian cybersecurity executive Edward Dubrovsky in connection with the ShinyHunters investigation, KrebsOnSecurity reported. Court records charge Dubrovsky with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion; prosecutors have asked that he remain in custody and that case records be sealed, according to Politico. A source close to the probe told KrebsOnSecurity that van der Stap’s Signal messages showed Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers and did not inform the bureau before the group threatened to publish the files.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageShinywire: a public extortion front and a U.S. consulting firm under scrutiny
Investigators say a now‑defunct extortion website called shinywire[.]com — active roughly from May 3, 2026 to October 16 — listed nearly 100 organizations compromised by ShinyHunters and urged victims to negotiate payment, publishing samples of stolen files and threatening publication if victims did not engage. KrebsOnSecurity reports the FBI believes at least one executive at a U.S.‑based consulting firm with more than 1,000 associates played an active role in operating that site; the outlet is not naming the company because no charges have been filed against the firm or its executives.
Links to Cypfer, Ghostbyte signals, and prior incidents
Reporting in The Globe and Mail detailed a civil dispute in Ontario between Dubrovsky and Daniel Tobok, former chief executive of Cypfer; Dubrovsky alleged he was being targeted as part of a campaign by a former partner. Independent tracking by Constella Intelligence ties an email address used by Tobok — dtobok@me.com — to online accounts where the username “ghostbyte” appeared, and reporting shows an earlier 2018 ransomware negotiation message recommended a Ghostbyte contact as a provider of guarantees. Cypfer has denied involvement in facilitating ransomware payments and told KrebsOnSecurity it learned of Dubrovsky’s arrest from media reports; the company said it had not been contacted by law enforcement and believes it is not under investigation.
Ransom negotiation practices, conflicts of interest, and recent prosecutions
The ShinyHunters case highlights long‑standing tensions over who negotiates ransom payments and how they are compensated. Mark Camillo, chief executive at CyberAcuView, told KrebsOnSecurity that negotiators who charge a percentage of the final ransom create misaligned incentives because they financially benefit from larger payments. The Department of Justice has in recent months prosecuted negotiators: on October 7 the DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging customers to remediate attacks while secretly paying hackers; in July Angelo Martino was sentenced to 70 months for conspiring with Blackcat/ALPHV to extort victims. Those prosecutions underscore the legal peril facing negotiators accused of colluding with attackers.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: the Shinywire leak of nearly 100 victims and evidence that negotiators sometimes knew of breaches before victims underscores the need to audit relationships with incident response vendors and to scrutinize how threat intelligence and breach notifications flow inside organizations.
- Policymakers and regulators: with the FBI warning victims against paying ShinyHunters on May 15, 2026 and the DOJ pursuing negotiators alleged to have defrauded clients, regulators will be watching fee structures and disclosures tied to ransom negotiation services and may push for more transparency about who is negotiating on a victim’s behalf.
- Affected enterprises and procurement leaders: the PowerSchool episode — where CyberSteward helped process a reported $2.85 million ransom after 62 million students and 9.5 million teachers' data were stolen in December 2024, yet subsequent extortion attempts continued — is a reminder that paying does not guarantee long‑term control over stolen data and that vendor selection carries legal and reputational risk.
The criminal and civil threads unearthed by van der Stap’s Signal logs, Dubrovsky’s arrest and sealed charges, the operation of Shinywire, and the linked corporate disputes form a tangle that investigators are still sorting. Federal prosecutors have already demonstrated a willingness to pursue negotiators; the central open question left by the reporting is whether the U.S. consulting executive(s) suspected of operating shinywire[.]com will face charges, or whether those connections will reshape how organizations choose and regulate ransomware negotiation services.
Source: KrebsOnSecurity, "Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site"
