A Canadian cybersecurity executive whose career has focused on helping clients negotiate with ransomware attackers has been arrested in the United States in connection with a hacking group that the FBI says stole a huge trove of sensitive data about the bureau’s own employees, according to court records and Reuters.
FBI Director Kash Patel said on social media Friday that the agency had arrested what he described as another suspected co-conspirator of the ShinyHunters group, a collective of hackers who have conducted dozens of data breaches since 2019, including a hack of an FBI database earlier this year.
Reuters, citing a person familiar with the matter, reported that the person arrested was Edward Dubrovsky, a Canadian who has worked as an executive at numerous cybersecurity firms and has been credited by a former employer with helping thousands of clients recover from cyberattacks.
Court documents from the U.S. District Court for the Eastern District of Pennsylvania reveal that Mr. Dubrovsky has been charged and list two criminal complaints: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats.
The documents contain unproven allegations and attempts to reach Mr. Dubrovsky were unsuccessful.
Canadian arrested in FBI hack that exposed employees’ personal data
The FBI declined to comment on Sunday, referring instead to Mr. Patel’s earlier social media post.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” the post said.
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
In September, the ShinyHunters hacking group claimed responsibility for the FBI hack, which the bureau said may have compromised the private information of tens of thousands of its employees and applicants. The group said it had taken action over false allegations contained in an FBI public advisory from May that described the organization as a “cyber criminal group specializing in large-scale data breaches and extortion.”
U.S. federal prison and court records show that a 54-year-old man named Edward Dubrovsky was detained in Philadelphia and appeared in U.S. court last Thursday. The alleged connection between Mr. Dubrovsky and ShinyHunters is not detailed in publicly available documents.
The court records are partially sealed and include inconsistent spelling of his last name (including Dobrosky and Dobrovsky). The records also do not identify his profession or employer.
Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a resident of Richmond Hill, a suburb north of Toronto, and put his current age at 54.
RCMP spokesperson Ian Lordon said Friday “the RCMP is aware of the arrest of a Canadian in the U.S. in connection with the ShinyHunters hack,” but directed all further questions to the FBI.
Global Affairs Canada did not respond to a request for comment.
Over the past three decades, Mr. Dubrovsky held several senior positions in the cybersecurity field, according to his LinkedIn profile. In a LinkedIn post from last week, Mr. Dubrovsky is seen in photographs posing with colleagues and signing copies of his recently published book at the NetDiligence conference in Philadelphia. He wrote about his excitement at attending the conference with digital security company CyberSteward, which is also displayed in his profile photo.
CyberSteward did not return a request for comment.
His LinkedIn profile lists his most recent permanent post as at CYPFER, a global cybersecurity firm based in Miami, Fla., with offices in Toronto. The company provides services in cybersecurity breaches, cyberextortion, and ransomware recovery and negotiations.
In a 2022 press release announcing Mr. Dubrovsky’s appointment as managing director, CYPFER described him as a “30-year veteran of the cybersecurity and technology industries.” He “has helped thousands of organizations of all sizes and industries recover from devastating cyberattacks and consulted to management boards, executives, legal counsel and insurance carriers on resilience and risk mitigation methodologies.” He left the company almost a year ago, according to his LinkedIn page.
A representative for the company could not be reached for comment.
Mr. Dubrovsky’s book, published last month, is about cyberextortion and strategies for managing a ransomware crisis.
“I have negotiated with criminals who viewed themselves as martyrs … even after deploying malware against critical infrastructure and causing billions of dollars in damage,” Mr. Dubrovsky wrote in his book.
“We must understand our opponents if we expect to survive on the digital battleground, and we must understand them better if we hope to reach common ground in negotiations.”
The FBI’s advisory from May characterized ShinyHunters as “threat actors” who often “use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims,” commonly harass or threaten people, and “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.”
The ShinyHunters group has also attacked Canadian companies. In March, Vancouver-based telecom company Telus Corp. said it was investigating a cybersecurity incident at a recently reacquired technology business line. The matter involved unauthorized access by the hacking group.
According to technology news website BleepingComputer, ShinyHunters said it stole nearly one petabyte of data from Telus Digital, including customer data, in a multi-month breach. The group demanded a ransom in exchange for not leaking the data.
With files from Reuters and Canadian Press