A Canadian cybersecurity executive whose career has focused on helping clients negotiate with ransomware attackers has been arrested in the United States in connection with a hacking group that the FBI says stole a huge trove of sensitive data about the bureau\u2019s own employees, according to court records and Reuters.<\/p>\n
FBI Director Kash Patel said on social media Friday that the agency had arrested what he described as another suspected co-conspirator of the ShinyHunters group, a collective of hackers who have conducted dozens of data breaches since 2019, including a hack of an FBI database earlier this year.<\/p>\n
Reuters, citing a person familiar with the matter, reported that the person arrested was Edward Dubrovsky, a Canadian who has worked as an executive at numerous cybersecurity firms and has been credited by a former employer with helping thousands of clients recover from cyberattacks.<\/p>\n
Court documents from the U.S. District Court for the Eastern District of Pennsylvania reveal that Mr. Dubrovsky has been charged and list two criminal complaints: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. <\/p>\n
The documents contain unproven allegations and attempts to reach Mr. Dubrovsky were unsuccessful.<\/p>\n
Canadian arrested in FBI hack that exposed employees\u2019 personal data<\/a><\/p>\n The FBI declined to comment on Sunday, referring instead to Mr. Patel\u2019s earlier social media post.<\/p>\n \u201cThis is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,\u201d the post said.<\/p>\n \u201cWe will continue to work closely with our partners to disrupt what\u2019s left of the ShinyHunters group and their associates, no matter where they operate.\u201d<\/p>\n In September, the ShinyHunters hacking group claimed responsibility for the FBI hack, which the bureau said may have compromised the private information of tens of thousands of its employees and applicants. The group said it had taken action over false allegations contained in an FBI public advisory from May that described the organization as a \u201ccyber criminal group specializing in large-scale data breaches and extortion.\u201d<\/p>\n U.S. federal prison and court records show that a 54-year-old man named Edward Dubrovsky was detained in Philadelphia and appeared in U.S. court last Thursday. The alleged connection between Mr. Dubrovsky and ShinyHunters is not detailed in publicly available documents.<\/p>\n The court records are partially sealed and include inconsistent spelling of his last name (including Dobrosky and Dobrovsky). The records also do not identify his profession or employer.<\/p>\n Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a resident of Richmond Hill, a suburb north of Toronto, and put his current age at 54.<\/p>\n RCMP spokesperson Ian Lordon said Friday \u201cthe RCMP is aware of the arrest of a Canadian in the U.S. in connection with the ShinyHunters hack,\u201d but directed all further questions to the FBI.<\/p>\n Global Affairs Canada did not respond to a request for comment.<\/p>\n Over the past three decades, Mr. Dubrovsky held several senior positions in the cybersecurity field, according to his LinkedIn profile. In a LinkedIn post from last week<\/a>, Mr. Dubrovsky is seen in photographs posing with colleagues and signing copies of his recently published book at the NetDiligence conference in Philadelphia. He wrote about his excitement at attending the conference with digital security company CyberSteward, which is also displayed in his profile photo.<\/p>\n CyberSteward did not return a request for comment.<\/p>\n His LinkedIn profile lists his most recent permanent post as at CYPFER, a global cybersecurity firm based in Miami, Fla., with offices in Toronto. The company provides services in cybersecurity breaches, cyberextortion, and ransomware recovery and negotiations.<\/p>\n