The cyber insurance industry gathered in Philadelphia on October 5–7 to talk about managing extortion risk. The day after it wrapped, federal agents in Pennsylvania allegedly arrested a man who, according to one source, had come to town for the event and who now faces extortion charges himself.
U.S. FBI Director Kash Patel announced on X on October 9 that agents had arrested "another suspected co-conspirator" of ShinyHunters. ShinyHunters is the data theft and extortion crew the bureau holds responsible for the September breach of its own jobs portal. Patel did not name the suspect. Reporting since then suggests the suspect may not be a hacker at all. Sources say he is someone whose job was to sit between ransomware victims and the criminals extorting them.
If that account holds, it is the second case in a year to put the ransomware negotiation industry under criminal scrutiny. Every organization with an incident response retainer or a cyber insurance policy has a stake in what comes next.
[RELATED: Ransomware Negotiator Secretly Worked Both Sides—then Joined the Conspiracy]
The official record is thin. Patel's post doesn't identify the suspect, give a location, or announce charges. Most details come from unnamed sources.
Citing two people familiar with the matter, The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and considered a primary co-conspirator in the intrusion. A law enforcement source told CBS News the suspect is believed to have been directly involved in the hack. The Royal Canadian Mounted Police told CBS it was aware a Canadian had been arrested in the U.S. in connection with the case.
KrebsOnSecurity went further. One source told Brian Krebs that the arrested man was in Pennsylvania for a cyber insurance conference, and that his company specialized in handling ransomware negotiations with cybercrime groups. Krebs identified the conference as NetDiligence's Cyber Risk Summit. He then linked the arrest to Edward Dubrovsky, a 54-year-old executive with the Canadian firm CyberSteward. Dubrovsky had posted on LinkedIn that he planned to attend the summit, where he was looking forward to discussing "compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services."
Federal court records add the most concrete detail. A docket indexed on CourtListener shows that an "Edward Dobrovsky," with the surname spelled slightly differently, was arrested in Pennsylvania on October 8. He faces two counts:
conspiracy to threaten to impair the confidentiality of information with intent to extort money
interference with commerce by threats
A notice filed the next day moved the case to the Eastern District of Texas. Krebs' sources describe that district as the center of the FBI's ShinyHunters investigation.
Several caveats matter here:
The core complaint is sealed. No public court record names ShinyHunters or the FBI breach. The link between the docket and the group rests on Krebs' sourcing and the venue transfer.
The charges don't match the "directly involved in the hack" framing. Both counts center on extortion, not unauthorized access to systems, so his alleged role is unclear.
No other outlet had independently confirmed the identification at the time of publication. The FBI declined to comment to Krebs, and reporters could not reach Dubrovsky.
He has no lawyer yet. Court records show he has no attorney and has not been appointed a public defender.
He is presumed innocent until proven guilty.
Even if the Dubrovsky case unravels, the risk it highlights is real. The industry has already seen it play out once, and that case ended in prison sentences.
In October 2025, federal prosecutors charged two DigitalMint ransomware negotiators and a former Sygnia incident response manager with carrying out ransomware attacks as BlackCat (ALPHV) affiliates. One of the negotiators, Angelo Martino, was charged in March with something worse. According to court documents, while representing victims at the negotiating table, he passed confidential information about those negotiations to BlackCat operators.
In July, the U.S. Justice Department announced that Martino had been sentenced to 70 months in prison. Prosecutors said he conspired to extort a combined $75.3 million from five U.S. companies that had trusted his firm to help them through a crisis. His co-conspirators, Kevin Martin and Ryan Goldberg, each received 48 months. DigitalMint has said it had no knowledge of the scheme and fired Martino after the DOJ notified it of the investigation.
The FBI official who summarized that case is now leading the response to the ShinyHunters breach. Brett Leatherman, assistant director of the FBI's Cyber Division, said of Martino: "Angelo Martino sold out the very victims he was hired to represent, handing their confidential negotiating positions to BlackCat actors to drive up ransoms and enrich himself."
Martino pleaded guilty to conspiracy to interfere with commerce by extortion. That is the same category of charge now listed on the Dobrovsky docket.
Most insider threat programs focus on employees with privileged system access. A ransomware negotiator has a different kind of access: access to the victim's decision-making.
During a live incident, the negotiator typically learns:
how much the victim can pay
whether backups are intact
how much pressure leadership is under
how close the deadlines are
what the insurance policy will cover
According to the DOJ's account of the DigitalMint case, Martino sold exactly that kind of information. He leaked victims' negotiating positions and their insurance policy limits. An extortion crew that knows a victim's coverage ceiling can set its demand right at that number.
That is what makes a corrupted negotiator so damaging. The victim isn't negotiating against the attacker; the attacker effectively has a seat at the victim's table. The usual controls don't catch it, because the negotiator is supposed to be talking to the criminals. Communication with the threat actor is the job, not an anomaly.
The scope may also extend beyond one person. Krebs reported, citing sources, that the FBI has been reviewing devices seized from Pepijn van der Stap, the Amsterdam man arrested in September. The same sources told Krebs that charges against principals at other ransomware negotiation firms may follow. That claim is single-sourced and unconfirmed. If it proves accurate, though, the problem would be bigger than one individual.
None of this means organizations should stop using professional negotiators. Experienced negotiators buy time, verify attacker claims, and often reduce payments. It does mean the negotiation function deserves the same scrutiny as any other high-trust third party.
Know who’s actually at the table. In many cases, an insurer assigns the negotiator through its panel rather than the victim choosing one. Review your policy now to see which firms are on the panel, and ask your carrier how it vets them. Find out whether you can bring your own vetted firm instead.
Route engagements through outside counsel. Having the negotiation firm retained by counsel creates privilege protections. It also gives you a party whose duty runs to you and who can oversee the negotiator's conduct.
Limit what the negotiator needs to know. The negotiator may need to know your payment authority. That doesn't mean they need your policy declarations page. Decide in advance which facts the negotiator gets, and keep coverage limits within the smallest possible group.
Require a complete record of every communication with the threat actor. Log and preserve every message to and from the attacker, and have someone outside the negotiation firm review it. Side channels that only the negotiator controls are a red flag.
Verify claims independently. When the negotiator relays something the attackers said, such as "they have 2TB of data" or "this is their final number," have your IR team or a second party check it against your own forensic findings and threat intelligence wherever possible.
Write it into the plan before you need it. Add these controls to your ransomware playbook and IR retainers now. Once an incident starts, nobody has the time or leverage to renegotiate vendor terms.
The Pennsylvania arrest is the third made public since ShinyHunters claimed the FBI breach in late September.
Netherlands, September 15. Dutch police arrested van der Stap a week before the group announced the FBI breach. The FBI described him as one of the group's alleged leaders. ShinyHunters told The Hacker News he has no association with it.
Jordan, late September. A suspect known as "Rey" was detained and is cooperating with investigators, Reuters reported, citing people familiar with the matter.
Accounts of how the breach happened conflict. Leatherman told Reuters that the intrusion followed a contractor's failure to apply a security patch issued specifically for the affected platform, and the FBI has since removed the contractor. ShinyHunters, by contrast, told BleepingComputer that it exploited an alleged Oracle PeopleSoft zero-day. Both accounts can't be true, and the FBI has not publicly named the platform or the contractor.
The stakes are high for the bureau. A sample of stolen data that ShinyHunters provided to Nextgov/FCW included names, home addresses, phone numbers, and information about relatives. The group says it won't publish the data, but nothing prevents it from being sold later.
The FBI alleges in a May advisory and subsequent statements that ShinyHunters has breached more than 140 organizations and collected at least $70 million in extortion payments. If even part of that money moved through intermediaries who were supposed to be working for the victims, the ShinyHunters investigation will also become an inquiry into the ransomware response industry.