FBI probes ties between ShinyHunters and ransom firms
Investigators say executives at two ransomware negotiators helped run a ShinyHunters extortion site.
20 Oct 2026 0 reads Compiled with AI
#ShinyHunters #FBI #Edward Dubrovsky #Shinywire #Pepijn van der Stap #Cypfer
Federal investigators are probing links between the ShinyHunters hacking group and executives at two ransomware‑negotiation firms. The probe centers on a now‑defunct extortion website, shinywire.com, that ran from about May 3 to October 16 2026 and listed almost 100 organizations targeted by ShinyHunters. The site combined samples of stolen files with demands for payment and threatened that victims who did not negotiate would see their data published on a separate Tor‑accessible leak blog.
Arrests and evidence
The investigation was set in motion after Dutch authorities arrested a suspected ShinyHunters member, Pepijn van der Stap, on September 15 2026. Investigators gained access to his Signal account, where he was seen communicating with Canadian cybersecurity executive Edward Dubrovsky and an executive at a U.S. consulting firm. Dubrovsky, 54, was later detained by the FBI and charged with threatening to disclose stolen information and interfering with interstate commerce through extortion.
Sources say the U.S. consulting firm, which employs more than 1,000 associates, had an executive who helped operate shinywire.com. The firm has not yet been charged, and its name has not been released by authorities.
The ShinyHunters raid of the FBI recruitment website, fbijobs.gov, in late September 2026 yielded medical and psychological records, Social Security numbers, and employee assignment details. The FBI moved quickly to arrest, detain and question anyone who had communicated with the group's current leader, Rey, and with other suspected ShinyHunters members.
Implications for the industry
The incident illustrates broader industry concerns about the role of ransomware negotiators. In 2024, PowerSchool paid $2.85 million to a ShinyHunters affiliate after a data breach, only to face further ransom demands using the same stolen data. Cypfer, a former partner of Dubrovsky, stated it does not facilitate ransom payments and had no knowledge of his arrest.
Investigators continue to examine how the extortion group and its alleged partners coordinated, with no charges yet filed against the U.S. consulting firm executive. The case highlights the risk that trusted intermediaries may be involved in criminal activities and the challenges of verifying claims that stolen data has been deleted after a ransom is paid.