Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday.

Edward Dubrovsky, 54, is a former employee of CYPFER, a firm that helps organizations negotiate with ransomware operators. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed. 

While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. FBI Director Kash Patel said in a social media post that the bureau had arrested “another suspected co-conspirator” of the group, but did not name the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

When asked for further comment, the FBI pointed CyberScoop to Patel’s social media post. 

Dubrovsky’s LinkedIn page touts him as the chief operating officer and ex-founder of CYPFER. However, a firm representing CYPFER told CyberScoop that his role was Managing Director from May 2022 through Dec. 2025.

Dubrovsky “had no affiliation, operational role or relationship with CYPFER since that time, and contrary to certain reporting, was never a founder or co-founder of the company,” the firm wrote in an email to CyberScoop.

Dubrovsky’s LinkedIn page also makes reference to an affiliation with CyberSteward, which is described as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month, Dubrovsky released a book covering how to deal with ransomware negotiations. 

Dubrovsky did not return CyberScoop request for comment. 

The FBI breach has drawn widespread attention. The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson. 

Brett Leatherman, the FBI’s assistant director for cyber, said a review found the breach resulted from a third-party platform, where a contractor had not installed a security patch issued for the system. Reuters reported that the contractor worked for Accenture.

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. Additionally, a teenager, which Reuters identified as Saif Al-din Khader, had been detained and was cooperating with investigators. 

Dubrovsky’s case docket states that the case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled. 

UPDATE: 10/13/2026, 11:25 a.m.: This story has been updated with comment from CYPFER.

The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop.

Authorities arrested an alleged leader of ShinyHunters, the notorious cybercrime group responsible for a string of high profile extortion attacks since 2025, including last week’s attack on the FBI.

The Dutch National Police said they arrested a 24-year-old man in Amsterdam accused of participating in the cybercrime group. Officials haven’t named the accused man, but independent cybersecurity journalist Brian Krebs identified him as Pepjin van der Stap, a previously convicted cybercriminal who moonlighted as a cybersecurity professional. 

The arrest, which occurred about a week before ShinyHunters claims it broke into FBI systems and stole reams of data containing sensitive information on almost every FBI agent, marks a major development for global law enforcement’s push to track down and arrest the group’s members. 

“Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement on YouTube Tuesday. “They often target third-party vendors in cloud-based platforms, stealing sensitive data and extort victims with threats to publish it.”

The Dutch National Police said they retrieved a large amount of evidence on van der Stap’s laptop, including details about two murders he allegedly ordered abroad. As the investigation continues, a court in Rotterdam ordered him to remain detained awaiting trial for at least 90 days. 

ShinyHunters is among the most prolific cybercrime groups currently in operation. It previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson.

“FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” FBI Director Kash Patel wrote in a post on X Tuesday. 

Leatherman, who described van der Stap as an alleged leader of the group, pulled further on that thread, speaking directly to other members of ShinyHunters in his recorded statement. 

“You’ve heard about the arrest of your colleague. We’re confident you’ve seen or heard things in recent days that the public has not. Other groups believed anonymity or their friends would protect them, and they were wrong,” he said. 

“Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you,” Leatherman added. “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”

The post Alleged ShinyHunters leader arrested in the Netherlands appeared first on CyberScoop.

Threat hunters and researchers are alarmed by what they’ve seen in data ShinyHunters claims it stole from the FBI. Limited samples of the stolen data contain FBI agents’ personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said.

“I am gravely concerned about the implications it opens up,” a researcher who has viewed and studied a sample of the data told CyberScoop. 

“It’s a roadmap for every s—y country, and drug cartel, and insane person to locate exactly who in the FBI they have a grievance with, and show up at their home or attack a person close to them,” the researcher who requested and was granted anonymity to share sensitive information added. 

In a lengthy post on its data-leak site, the group claimed it stole data on almost every FBI agent and people who applied for an agency job. The FBI jobs site, which was temporarily defaced by ShinyHunters, remains offline as of Monday. 

The FBI hasn’t confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is “actively and aggressively investigating” the incident, the root cause and its alleged impact to FBI employees’ personally identifiable data in a statement Wednesday.

Stolen data puts FBI agents at serious risk

While the full scope of the attack remains under investigation, cybercrime experts are startled by the potential counterintelligence exposure and safety risks lurking in data ShinyHunters has shared with journalists in a bid to bolster its claims and mount public pressure on the FBI. CyberScoop has not viewed the stolen data. 

“The counterintelligence concern is that assignment information could help hostile actors identify people working on issues relevant to them. That creates risk for personnel and could put sources or investigations connected to their work at risk,” said Jon DiMaggio, principal researcher at Arkem Cyber.

“I know firsthand what it is like to have the people you are investigating know who you are. It adds a different dimension to the stress and mental weight of the job,” he added. “If the information is accurate, agents may have to consider the possibility of being targeted directly. It is a whole different ball game when you do not know the identity of the person you are investigating, but they know exactly who you are.”

Cynthia Kaiser, a former FBI official, noted that some of the data ShinyHunters stole from the FBI has already been distributed widely beyond control. The sample data ShinyHunters shared with journalists was available on its internal forum, granting anyone with access the ability to pass the information on to others, she wrote in a LinkedIn post.

“The link no longer works, but the damage is done. Screenshots, downloads, emails — once data is disseminated, you can’t pull it back and delete all copies,” wrote Kaiser, now a senior vice president at Halcyon’s ransomware research center. 

“Even technically, once threat actors send victims a sample of what they stole, they have probably made five-plus copies of the stolen data,” she added. “There is no way to verify all data was deleted, and the FBI has said that whenever it gets onto ransomware group infrastructure, it finds data that the group promised would be deleted.”

Experts dumbfounded by ShinyHunters’ claimed objective

ShinyHunters said it targeted the FBI and stole sensitive data to refute details the agency shared in a public service announcement it issued in May about the group’s operations, affiliations and tactics. 

The cybercrime group disputes multiple FBI assertions and specifically insists it is not affiliated with The Com, has never conducted swatting attacks or claimed it had sensitive or compromising information, including embarrassing photos or videos, to extort victims.

ShinyHunters said it wants the FBI to remove or amend the public service announcement, and set a Monday deadline for the agency to take action.

Researchers are dumbfounded by ShinyHunters’ coercive action. “This is retaliation, which is crazy because they have just put a massive target on themselves. But clearly they are not concerned about the FBI and do not believe the bureau has the capacity to find and arrest them,” DiMaggio said. 

“The thing they are trying to extort is truly insane. They want to censor an FBI report because their feelings are hurt,” the anonymous researcher told CyberScoop. 

“Their best course of action would be to walk away from the entire situation,” the researcher added. “They need to walk away from the issue and leave this data alone.”

‘This one’s personal’

ShinyHunters typically engages in cybercrime for financial extortion. The threat group previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Some of the group’s most high-profile victims this year include Instructure, Salesforce, Snowflake and McKesson.

Various cybercriminals have been tied to activity attributed to the ShinyHunters name. “My assessment is that it operates as a criminal brand used by a fluid network, with a core group and a wider circle of associates who may support access, data handling, infrastructure or distribution,” DiMaggio said.

“The people and roles can change, and the name alone does not identify who was behind this intrusion,” he added. 

The anonymous researcher concurred with that analysis, adding that multiple people are likely involved with some potential internal conflicts and disagreement over the attack on the FBI.

Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia. 

Yet, “this one’s personal, and that’s the difference,” DiMaggio said. 

“It’s not just an agency getting hacked. It’s agents’ identities, their work, and possibly their families being exposed,” he added. “These guys don’t just attack organizations for money. Often it’s for clout and bragging rights or a personal vendetta, which I believe is the case here.”

ShinyHunters’ public attempt to extort the FBI marks a major point of escalation riding on a rare motive. 

“The tactics and methods behind the attack are the same as any data theft compromise. The difference is the damage it can cause to the organization and the people who are supposed to prevent and prosecute criminals like ShinyHunters,” DiMaggio said.

“This was a bold, personal move against law enforcement and has less to do with money,” he added. “There is a financial component, but the publicity and bravado likely mean more to the criminals than the money.”

The post ShinyHunters trades financial extortion for a reckless war of ego with the FBI appeared first on CyberScoop.

The FBI is investigating an attack on its own systems after ShinyHunters claimed responsibility for the incident, putting the prolific cybercrime group in the most direct conflict yet with agents responsible for investigating data extortion attacks.

The Monday breach, first reported by 404 Media, allowed ShinyHunters to temporarily deface the FBI jobs site. The group claimed it stole “very sensitive data on almost all FBI agents and individuals who filed an application with the FBI for a job,” in a lengthy post on its data-leak site.

“The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating,” a spokesperson for the agency said in a statement.

An alert on the FBI jobs site notes that apply.fbijobs.gov and the Special Agent Application Portal are currently unavailable.

The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson.

“The ShinyHunters ransomware group appears to be actively trying to put a target on their back,” Cynthia Kaiser, senior vice president at Halcyon’s ransomware research center, told CyberScoop. 

ShinyHunters claims it targeted the FBI in response to a public service announcement it says contains false allegations about the group. The FBI issued the PSA following ShinyHunters’ May attack on Instructure, the company behind Canvas, a widely used central hub for K-12 and university coursework, exams and communication. 

The group responded with its own “PSA” on its data-leak site, insisting it is not affiliated with The Com, has never conducted swatting attacks or claimed it had sensitive or compromising information, including embarrassing photos or videos, to extort victims. 

The PSA was addressed to Brett Leatherman, assistant director of the FBI’s cyber division, and FBI Director Kash Patel. 

“While ShinyHunters has in the past been hyperbolic about the criticality of the data they’ve accessed, the group has established itself as a legitimate threat,” Flashpoint analysts told CyberScoop. 

“This attack benefits ShinyHunters by bolstering their reputation as a credible threat,” the analysts added. “In the group’s statement on their leak site regarding the breach, they portray the FBI’s PSA as an “attempt to ‘disrupt’ our operations and hinder clients’ trust in our organization hoping nobody pays us.”

The threat group typically uses social engineering, abuses weaknesses in identity systems or exploits vulnerabilities to gain access to cloud-hosted environments containing troves of sensitive or proprietary data, which it threatens to leak if the victim doesn’t pay a ransom.

ShinyHunters doesn’t appear to be seeking a payoff in this case, but rather a bid to coerce the FBI into amending or removing the May PSA. The group didn’t make any direct threat in the data-leak site post to release the stolen data, but it set a deadline of one week for action.

That coercive approach toward the FBI could backfire, according to experts. 

“Ransomware groups are largely successful because they operate like businesses,” said Kaiser, a former deputy assistant in the FBI’s cyber division. “Targeting other criminal groups or law enforcement — especially in ways intended to publicly shame — demonstrates a lack of discipline that historically has led to takedowns, takeovers or defections.”

The post ShinyHunters claims attack on FBI exposes almost all agents appeared first on CyberScoop.

McKesson said its business and distribution centers remain operational in the wake of a cyberattack it disclosed Friday that resulted in data theft and temporary service interruptions.

Attackers gained access to some of the health care vendor’s third-party applications and stole data associated with a subset of customers in the company’s oncology, multispecialty and medical-surgical business units, Francisco Fraga, chief information and technology officer at McKesson, said in a statement Saturday. 

McKesson is a major player in the healthcare sector, claiming it distributes about one-third of all pharmaceuticals used throughout North America. It reported $403.4 billion in revenue for the one-year period ending in March. 

The company’s size and critical role it serves also makes it a high-profile target for cybercriminals. McKesson did not identify the group behind the attack, but ShinyHunters, a cybercrime group known for targeting large organizations with extortion demands after stealing massive amounts of sensitive data, claimed responsibility.

The company declined to answer questions about ShinyHunter’s claims. Yet, on Friday, McKesson disclosed the attack in a regulatory filing while ShinyHunters added the company to its data-leak site. 

McKesson said it discovered the attack Aug. 25. A period of widespread data theft was over by then, following a four-day intrusion beginning Aug. 21, according to researchers.

“Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to support our response,” Fraga said in a statement. 

“We have reasonable assurance of no ongoing unauthorized activity in our systems. Customers can continue to connect to and use our systems and services as intended,” he added. 

While McKesson’s investigation continues, it faces a more urgent deadline of Sept. 1 from ShinyHunters, which is reportedly seeking a ransom demand in excess of $55 million. 

The company did not answer questions about any ransom demand or whether it responded to the alleged attackers. 

The circumstances of the attack against McKesson are similar to other recent victims of ShinyHunters. The threat group typically uses social engineering or abuses weaknesses in identity to gain access to cloud-hosted environments containing troves of sensitive or proprietary data, which it threatens to leak if the victim doesn’t pay a ransom. 

“Opportunistic data extortionists have been able to identify weaknesses within identity and access management, making these campaigns both cheap and scalable,” said Ian Gray, vice president of cyber threat intelligence at Flashpoint. 

“These attacks are particularly difficult to detect early because they often occur entirely within vendor-hosted environments using valid, socially-engineered credentials,” he added. “Since this activity mimics normal support or data-warehouse tasks, it typically doesn’t trip traditional malware alerts or show anomalies, meaning organizations often remain unaware of the breach until the extortionists make contact.”

Researchers have linked ShinyHunters to multiple attack sprees targeting major cloud platforms, including Oracle, Salesforce and Snowflake. The decentralized crew of cybercriminals was also linked to an expansive compromise last summer impacting hundreds of Salesloft Drift customers that put any platform integrated with the AI chat agent at risk as well. 

In April, ShinyHunters broke into the systems of Canvas — a central hub for K-12 and university coursework, exams, grades and communication — causing widespread outages and data theft. When an early deadline passed without payment, ShinyHunters escalated its pressure on Instructure, the company behind Canvas, by defacing the platform’s login pages with an extortion message that was visible to hundreds of schools.

Instructure ultimately relented and said it reached an agreement with the cybercriminals, insisting the stolen data was returned with assurances that other copies were destroyed.

The FBI issued a public service announcement about ShinyHunters days later, warning potential downstream victims of the threat group’s pressure tactics and claims.

In late July, less than a month before McKesson was hit, Health-ISAC warned organizations in the sector of an increase in successful attacks by ShinyHunters.

The post McKesson copes with fallout from data theft extortion attack appeared first on CyberScoop.