A cybersecurity executive whose firms negotiated ransomware payments is charged with extortion

Edward Dubrovsky, 54, is in federal custody on federal extortion-related charges. Charges are allegations; he has not been convicted. The complaint is sealed, so the public record does not yet say what he is accused of doing.

Dubrovsky was arrested in Pennsylvania while attending a cybersecurity conference. He had posted on LinkedIn that he planned to attend the NetDiligence Cyber Risk Summit there with the CyberSteward team, and he recently published a book titled Cyber Extortion Strategic Response. The arrest became public on October 9, 2026.

The extortion counts on the docket

Dubrovsky, 54, a Canadian cybersecurity executive, is in federal custody facing charges of conspiracy to threaten to impair the confidentiality of information with intent to extort money, along with Hobbs Act extortion and conspiracy to commit it. According to BleepingComputer, he co-founded CYPFER and has been associated with CyberSteward, firms whose business is helping breach and ransomware victims negotiate and send extortion payments. The reporting ties him to those firms; it does not say he personally conducted any negotiation. The charges appear on the court docket in statute shorthand. BleepingComputer’s report quotes the first entry as “18:371 AND 1030(a)(7)(B) – CONSPIRACY TO THREATEN TO IMPAIR THE CONFIDENTIALITY OF INFORMATION WITH THE INTENT TO EXTORT MONEY.” Section 371 is the general federal conspiracy statute, and Section 1030 of Title 18 is the Computer Fraud and Abuse Act, whose subsection (a)(7) addresses extortion tied to computers.

The second entry reads “18:1951(a) AND (b)(2) – INTERFERENCE WITH COMMERCE BY THREATS (HOBBS ACT EXTORTION AND CONSPIRACY TO COMMIT HOBBS ACT EXTORTION).” That language tracks Section 1951, the Hobbs Act. Neither entry describes conduct. The docket gives a label for each count and nothing about who was threatened, what was taken or what was demanded, because the underlying complaint remains under seal. The case is filed as United States v. Dobrovsky on CourtListener, with a spelling that differs from the one used in news coverage. BleepingComputer points out that discrepancy, which matters for anyone searching records by name.

A ransomware negotiator in the dock

What makes the case unusual is the defendant’s trade. Ransomware negotiation firms sit between a hacked company and the criminals holding its data: they open the channel, haggle over the demand and often arrange the payment. According to BleepingComputer, Dubrovsky has held senior roles at firms that do exactly this for victims. Politico, as relayed in that report, says CyberSteward is a trade name used by CYPFER and that the firms help organizations negotiate and send payments to cybercriminals.

Such firms necessarily learn the most sensitive facts of an incident: what was stolen, how the intruders got in, what the victim can afford and how badly it wants the matter closed. The charges allege extortion, not misuse of that knowledge, and no source ties the accusation to any client of his firms. The point for businesses is simpler and stays an open question until the complaint is unsealed: the outsiders trusted in the worst week of a company’s year hold a great deal of leverage. Neither CYPFER nor CyberSteward is quoted in the BleepingComputer report, which carries no official statement from either company.

The ShinyHunters connection

The charges arrive amid a broader FBI push. FBI Director Kash Patel announced the arrest of “another suspected co-conspirator of the ShinyHunters group,” and the New York Times reported that the suspect was a Canadian citizen arrested in Pennsylvania and believed to be a primary co-conspirator in the ShinyHunters hack of the FBI’s jobs site. The FBI has not publicly confirmed that Dubrovsky is that person. KrebsOnSecurity reported that multiple sources linked his arrest to the investigation, while BleepingComputer says it is still unclear what he is accused of or whether the case connects to the FBI breach.

The group’s scale comes from the FBI, as relayed by BleepingComputer: more than 140 organizations breached and more than $70 million collected in extortion payments over the past year. Those figures describe ShinyHunters as a whole. BleepingComputer states plainly that no dollar amounts and no victims are tied to Dubrovsky, and readers should not attribute the $70 million to him. The same outlet earlier covered the group’s claimed breach of the FBI through a PeopleSoft zero-day, and describes ShinyHunters as an extortion group that steals data from web applications and software-as-a-service platforms and has also run an extortion-as-a-service operation.

Courts, custody and what remains unknown

Dubrovsky first appeared in the Eastern District of Pennsylvania. A later court order shows he was transferred to the Eastern District of Texas, where the charges were filed, and that he remains in custody. His detention status therefore rests on a court order rather than on any statement from prosecutors in the report.

Other arrests tied to alleged ShinyHunters members have been reported in recent weeks, including in the Netherlands and Jordan, according to BleepingComputer. Whether those cases and this one share evidence is not stated anywhere in the reporting. The arrest date itself is also not given; the report says only that he was detained in Pennsylvania at the conference.

Until the complaint is unsealed or an indictment is returned, the facts are thin: a name, a trade, a list of statutes and a court transfer. Charges are allegations, and Dubrovsky has not been convicted of anything. What the sealed filing eventually says about his role, if any, in the ShinyHunters campaign will decide whether this is a story about one man or about the vulnerability of an industry built on trust in intermediaries.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview