A Canadian ransomware negotiator is in federal custody in Philadelphia on extortion charges as the FBI hunts hackers behind a claimed theft of nearly every bureau employee's personnel data.
The New York Post reported that Edward Dubrovsky, a 54-year-old cybersecurity executive who specializes in talks with ransomware crews, was arrested Thursday in the Philadelphia area on federal charges.
Court records in the Eastern District of Pennsylvania describe counts tied to conspiracy to threaten the confidentiality of information to extort money, plus interference with commerce. A separate criminal case in the Eastern District of Texas remains sealed, so the concrete acts behind those labels are still unclear.
That sealed Texas matter is where the case is headed next. A Pennsylvania judge ordered Dubrovsky held after prosecutors sought detention, pending a hearing there. A Friday order then directed the U.S. Marshals Service to move him for further proceedings.
The Federal Bureau of Prisons inmate locator lists him at the Federal Detention Center in Philadelphia, with the release date marked unknown.
On Friday, FBI Director Kash Patel announced on X that field agents had grabbed another suspected co-conspirator of the ShinyHunters group. He did not name the person in custody.
Patel wrote:
"Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group, the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,"
He added that the arrest was the latest involving that network in a matter of days as the bureau works to dismantle the group and chase more leads.
ShinyHunters recently claimed it stole information concerning nearly every FBI employee. Patel tied the group to the FBIjobs.gov breach on a third-party vendor platform. What authorities have not done is publicly confirm that Dubrovsky is the suspect Patel described, or that his case is part of that same investigation.
Those gaps matter. A sealed Texas docket and an unnamed reference in a director’s post leave the public with charge titles, a detention order, and a timeline that lines up on paper, not a proven bridge between the Canadian negotiator and the personnel-file theft.
Dubrovsky’s LinkedIn profile ties him to CyberSteward, a firm that advertises work on talks with threat actors, cyber extortion, and settlement facilitation. In plain terms, his lane is the middle seat between hackers demanding payment and victims trying to limit the damage.
That business exists because ransomware crews keep hitting companies and institutions, locking systems and dangling stolen data for cash. When federal prosecutors instead charge a man in that line of work with conspiracy to threaten confidentiality for extortion money and with interference with commerce, the posture is straightforward: the government is treating the conduct as crime, not consulting.
Reuters reporting on the Pennsylvania filings supplied the charge descriptions carried in coverage of the arrest. The Texas case stays closed to public view for now, which keeps the alleged scheme’s details off the record.
The sequence ran fast. Thursday brought the Philadelphia-area arrest and a Pennsylvania order holding Dubrovsky for a Texas detention hearing. Friday brought the Marshals transport directive and Patel’s ShinyHunters update.
Federal agents, prosecutors, a judge, the Marshals Service, and the Bureau of Prisons all moved in short order. The defendant is in a Philadelphia federal lockup while the sealed Texas matter waits.
For FBI employees whose personal information was claimed as loot in the ShinyHunters pitch, the bureau’s message under Patel is that co-conspirators are being sought and taken into custody. For everyone else watching cybercrime spill into government personnel systems, the open questions are the ones courts usually answer later: who did what, on which systems, and for what payoff.
Until that sealed file opens, the verified picture stops at a named Canadian negotiator in federal detention, extortion-linked charge labels in Pennsylvania records, a Texas case under seal, and an FBI director hunting ShinyHunters without putting Dubrovsky’s name on the post.
Hackers who target the people sworn to enforce the law should expect handcuffs, not a negotiating table, and anyone in the middle of that trade should not be shocked when federal prosecutors show up with paperwork of their own.