Federal authorities arrested a Canadian cybersecurity executive and ransomware specialist in Pennsylvania amid a widening investigation into a cyberattack that compromised thousands of FBI personnel records, court documents and officials revealed.
Edward Dubrovsky, 54, was taken into custody Thursday in the Philadelphia metropolitan area, according to federal filings cited by Reuters and CNN. The arrest came as investigators work to dismantle ShinyHunters, a prolific cybercriminal syndicate that claimed responsibility for penetrating an unclassified job portal operated by the bureau.
Extortion Charges and Transfer to Texas
Court records filed in the U.S. District Court for the Eastern District of Pennsylvania show Dubrovsky faces allegations involving conspiracy to threaten the confidentiality of information to extort money as well as interference with commerce, Reuters reported. The underlying criminal complaint remains under seal in the Eastern District of Texas, where Dubrovsky is being transferred for a detention hearing.
During a court appearance Thursday in Philadelphia, a federal magistrate judge appointed a public defender to represent Dubrovsky, CNN reported. Online records from the Federal Bureau of Prisons showed him held at the Federal Detention Center in Philadelphia ahead of his transfer to Texas. Dubrovsky and his appointed legal counsel did not immediately comment on the matter.
On Friday, FBI Director Kash Patel announced on the social media platform X that field agents had apprehended another suspected participant linked to the breach. Patel did not publicly identify the individual, but multiple sources familiar with the matter told CNN that the suspect was Dubrovsky.
“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” Patel wrote.
Breach of Federal Personnel Records
The cyberattack, discovered in late September, targeted FBIjobs.gov and exposed the personal details of thousands of current and former personnel. According to internal notices described by ABC News, the compromised records included names, home addresses, phone numbers, email addresses, Social Security numbers, dates of birth, and emergency contacts. Sources told ABC News that the bureau has been operating under the assumption that nearly every employee’s personal data was accessed.
People who examined the compromised files told CNN that the stolen database exposed identities of personnel assigned to sensitive counterintelligence units focusing on China and Russia. Following the breach, ShinyHunters demanded on its dark-web site that the bureau modify a prior advisory about the group’s extortion tactics, though the group subsequently claimed it had abandoned plans to publish the data.
The bureau confirmed that the incident stemmed from an unpatched human resources platform managed by an outside contractor. Brett Leatherman, the FBI’s assistant director for cyber operations, stated that the bureau removed the contracting firm after finding it had neglected to install a software patch designed to safeguard the system.
Widening Global Investigation
The arrest in Pennsylvania represents the latest action in an international push to dismantle ShinyHunters. Dutch authorities arrested an alleged leader of the hacking group last week, according to FBI statements.
Dubrovsky is widely known in the cybersecurity sector as an expert on ransomware incidents and extortion negotiations. A LinkedIn profile under his name describes him as affiliated with CyberSteward, a firm that advertises services for negotiating with extortionists and settling ransom demands, and lists him as an author of a book on ransomware negotiation strategies.
Federal prosecutors have not yet detailed Dubrovsky’s specific alleged conduct in connection with the breach. Dubrovsky remains in federal custody awaiting proceedings before a federal magistrate in the Eastern District of Texas.
