Edward Dubrovsky built a career telling hacking victims how to survive a ransomware attack. Now the 54-year-old cybersecurity executive is behind bars, accused by federal prosecutors of colluding with the very criminals he claimed to fight, after the FBI arrested him in Philadelphia amid a probe tied to the hacking gang ShinyHunters.
Dubrovsky was detained while in Philadelphia for a cybersecurity conference, according to CBC News, which reports he is accused by U.S. prosecutors of colluding with cybercriminals to extort money from his own clients. He was taken to the Philadelphia detention centre on October 7 and remained held there as of Friday. The public complaint detailing the specific allegations against him remains sealed, as confirmed by Politico.
Court records reviewed on the docket for United States v. Dubrovsky show Dubrovsky had an initial 14-minute hearing in U.S. District Court on October 8, according to CBC's reporting. The court appointed the Federal Defenders to represent him, and per the docket obtained by courtlistener.com, he was detained pending a detention hearing in the charging district. U.S. Magistrate Judge Scott W. Reid ordered him held in custody until transport to Texas, and the docket states he was committed to the Eastern District of Texas for further proceedings.
Extortion Conspiracy and Interference Charges
Dubrovsky was charged with an extortion conspiracy offense and interference with commerce by threats, according to the public docket cited by CBC. Politico similarly reports he is now charged with conspiracy to commit that crime by threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. He is suspected, per U.S. court allegations, of involvement with threat actors linked to ShinyHunters — the group that claimed responsibility in September for hacking an FBI jobs portal and stealing a large trove of data, and which typically demands ransom payments in exchange for not releasing data it obtains.
FBI Director Kash Patel said the bureau had arrested a suspected ShinyHunters co-conspirator, and the RCMP said it was aware a Canadian had been arrested in connection with the case. Krebs on Security, citing federal estimates, reported that ShinyHunters has extorted more than $70 million from victims so far this year, and that a now-defunct extortion site tied to the group, Shinywire, was active from roughly May 3 until October 16 and listed entries for nearly 100 organizations.
Monero Payments and Business Dealings in Question
Anthony Carissimi told reporters in Philadelphia on October 8 that Dubrovsky was working on behalf of the threat actors, and predicted his business would dry up as a result. Carissimi said Dubrovsky's alleged fraud involved his own clients and business partners, and that Dubrovsky engaged in cryptocurrency exchanges with people including criminal elements, dealing in Monero — a cryptocurrency Carissimi described as renowned for being untraceable.
Dubrovsky's court-appointed defense has said he will contest the charges. Tim Wright described the allegations against Dubrovsky as untested and said his client wants to fight the case to clear his name. Wright said Dubrovsky had planned to attend a conference in Canada around October 15 and planned to return to the U.S. for an event in South Carolina.
CYPFER and Hamilton Ransomware Case
Dubrovsky previously served as managing director at CYPFER, a firm that was tasked with helping the city of Hamilton, Ontario, recover from a 2024 cyberattack in which attackers demanded $18.5 million to unlock city systems — a ransom Hamilton did not pay, according to CBC's earlier reporting. In an official statement, CYPFER said Dubrovsky served as managing director from May 2022 through December 2025, was never a founder or co-founder of the company, and had no affiliation, operational role or relationship with CYPFER after leaving. The company also said Dubrovsky did not perform any work on Hamilton's case.
Dubrovsky was also associated with CyberSteward, described by cyberscoop.com as a Toronto-based firm that helps breach victims negotiate ransom payments. CyberSteward shared a picture of Dubrovsky signing copies of his book at the NetDiligence conference on October 6 in Philadelphia, but the company has not responded to multiple requests for comment on its ties to Dubrovsky or his current employment status. NetDiligence's event ended at 11:30 a.m. on October 7, and Heather Osborne said that to her knowledge, Dubrovsky's arrest did not occur at the NetDiligence event itself.
A Career Built on Fighting Hackers
On his LinkedIn profile, Dubrovsky describes himself as a globally recognized cybersecurity expert who helps clients negotiate with ransomware attackers. He published a book titled Cyber Extortion: Strategic Response and was hired as a cybersecurity instructor at York University. He holds a Canadian passport, originated from Latvia, and held an Israeli passport at one point. Back in 2018, Dubrovsky said every system in the world has vulnerabilities.
David Shipley, CEO of Beauceron Security in Fredericton, told CBC News that Dubrovsky's case highlights his reservations about ransomware negotiators generally. Shipley urged ransomware victims with backups to restore uninfected files rather than pay a ransom, and said paying attackers does not guarantee relief. The case echoes a separate matter in the Eastern District of New York, where, according to the U.S. Department of Justice, cybersecurity consultant Zohar Pinhasi was arraigned on wire fraud charges over claims he could decrypt ransomware without paying cybercriminals.
