U.S. federal investigators reportedly suspect that executives connected to ransomware negotiation firms maintained unusually close relationships with ShinyHunters—and that one executive at a large U.S. consulting company helped operate the group’s extortion website.
The claims come from a KrebsOnSecurity investigation based largely on anonymous sources, court records and previously published reporting. The unnamed consulting executive has not been charged, according to the report.
A second figure, Canadian cybersecurity executive Edward Dubrovsky, faces charges related to threatening the disclosure of stolen data and interfering with interstate commerce through extortion. KrebsOnSecurity reported his arrest on 9 October. The reported connection between Dubrovsky’s case and ShinyHunters comes from the publication’s sources rather than the publicly described charges.
Shinywire acted as a payment-pressure platform
The disputed operational link centers on shinywire[.]com, an extortion site that Krebs says became active around 3 May 2026. The domain was defunct by 16 October.
The site contained entries for nearly 100 organizations that ShinyHunters claimed to have compromised. Each page sought to move the organization into payment discussions, displaying samples of allegedly stolen files and threatening publication if the demand was ignored.
Organizations that did not engage within seven days were reportedly moved to a separate ShinyHunters victim-shaming site accessible through Tor. Nearly 100 listings represent organizations named by the attackers, not a confirmed count of successful intrusions or affected people.
One listed company was Intuitive Surgical. According to the report, the U.S. medical technology company was breached in March 2026 after a targeted phishing message compromised an employee’s credentials. That incident describes one entry point and should not be treated as the method used against every organization on the site.
Two anonymous sources told Krebs that FBI investigators believe at least one executive at a U.S. consulting firm with more than 1,000 associates actively helped run Shinywire. Neither the firm nor the suspected executive was identified.
Signal messages reportedly expanded the investigation
Dutch authorities arrested Pepijn van der Stap, a convicted hacker and alleged ShinyHunters participant, on the evening of 15 September 2026. Police reportedly used flash-bang grenades while he was logged into online accounts.
An anonymous source said Van der Stap was using Signal at the time, allowing investigators to read recent conversations with frequent contacts. Those contacts allegedly included ransomware negotiators in Canada and the United States.
According to the source’s description of the messages, Van der Stap regularly communicated with Dubrovsky and at least one executive from a major U.S. consulting firm. The executives allegedly sometimes knew about newly compromised ShinyHunters targets before the organizations themselves became aware.
The same source alleged that Dubrovsky knew ShinyHunters had obtained sensitive FBI information but did not warn the bureau before the group threatened to publish it on Twitter/X.
In late September, ShinyHunters reportedly breached fbijobs.gov, the FBI’s recruitment website. The group claimed possession of medical and psychological records, Social Security numbers, home addresses, and information about employees’ units and specializations. The claimed contents do not by themselves establish the full scope of any theft.
Dubrovsky faces extortion-related charges
Dubrovsky, 54, is charged with threatening to release stolen or hacked information and interfering with interstate commerce through extortion, according to court records described by Krebs. Prosecutors have reportedly asked that he remain in custody pending trial. The records are sealed, and no conviction has been reported.
Dubrovsky previously served as managing partner and chief operating officer of Toronto-based Cypfer. On 14 October, Cypfer said it learned about his arrest through media coverage and had no advance knowledge of it. The company also said law enforcement had not contacted it and that, to its knowledge, it was not an investigative target.
Cypfer stated that its business does not involve making or facilitating ransomware payments. It also said that Cypfer and CyberSteward Inc.—a company associated with a separate commercial dispute involving Dubrovsky—share no officers, directors or employees.
These are company statements. They do not resolve the anonymous-source allegations about Dubrovsky or the unidentified U.S. executive.
The immediate risk is not a software vulnerability
The allegations describe a potential insider and supply-chain problem within ransomware response services, rather than a technical flaw that organizations can fix with a patch. As general background, the Justice Department said in a separate BlackCat case that ransomware negotiator Angelo Martino provided attackers with confidential information about clients’ negotiating positions and strategies, enabling them to maximize ransom payments. The ShinyHunters report does not establish that the same information was disclosed in this campaign.
As a general risk-control measure, organizations hiring such providers should limit access to negotiation strategy and maintain records showing who viewed or shared sensitive case material.
Coveware and Unit 221B reportedly advise victims against paying ShinyHunters because stolen information may still be retained, sold or used in another extortion attempt. A payment or deletion promise should therefore not be treated as evidence that exposed data has been destroyed.
