A ransomware negotiator is a person a company hires to talk to the people holding its data. The job means learning about a breach early, holding the victim's own estimate of what its data is worth, and advising on whether to pay.

KrebsOnSecurity reported this month that the FBI has arrested one such executive, and that investigators suspect a second, at a different firm, of helping to run the website where victims were pressured.

What Shinywire was

Shinywire was the extortion site used against victims of the hacking group ShinyHunters. It ran from about 3 May 2026 to 16 October 2026 and is now defunct. Entries covered nearly 100 organisations, each one urging the victim to make contact and discuss payment terms, each carrying samples of the stolen files.

A victim that did not engage within seven days had its data posted to the group's victim-shaming blog on Tor. Among the listed organisations was Intuitive Surgical, which Krebs reports was breached in March 2026 through a targeted phishing email.

What is charged

Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, was arrested by the FBI in connection with the ShinyHunters investigation. Krebs reported the arrest on 9 October.

The court records carry 2 counts: threatening to disclose stolen or hacked data, and interfering with interstate commerce through extortion. Politico reports that prosecutors asked for him to remain in custody pending trial, and that records in the case stay sealed. The docket is listed under a different spelling of his surname.

Dubrovsky is described as a former managing partner and chief operating officer of the Toronto-founded firm Cypfer, and previously a managing partner at Cytelligence. He has published a book on handling cyber extortion which recommends always engaging with the attackers.

Cypfer says it had no prior knowledge of the arrest and has not been contacted by law enforcement. A separate business dispute is on the record: a former Cypfer chief executive has counterclaimed that Dubrovsky misrepresented himself as a founder and worked at a competing firm, and Cypfer says it has no officers, directors or employees in common with that firm.

What is suspected, and is not a charge

Two sources close to the investigation told Krebs that FBI investigators believe at least one executive at a United States consulting firm "played an active role in operating" Shinywire. That person has not been charged, and is not named, and nor is the firm, described only as having more than 1,000 associates.

Krebs withholds both identities for that reason. We are following that and will not speculate about either.

The same sources describe Signal messages recovered from another arrested suspect which they say show frequent contact with Dubrovsky and with the unnamed executive, and which they say show those contacts learning of new victims before the victims did. Sources also say the messages show Dubrovsky knew ShinyHunters had stolen FBI data and did not tell the bureau before the group threatened publicly to leak it.

None of that is in the charges. It is what unnamed sources have told one reporter about an open investigation, which is a real thing and a different thing.

Why the seat matters

Set the allegations aside and the structural point stands on its own, because it is true of the job rather than of any person in it.

A negotiator is retained by the victim and talks to the attacker. They are told about an incident in the first hours, before customers, before regulators, often before the board. They learn what the company believes its own data is worth, which is the single most useful number an extortionist can have. And with a 7-day clock running on the listing, the pressure to engage is the product.

The commercial model rewards engagement too, because a firm paid to negotiate has nothing to do if nobody negotiates.

That is an ordinary conflict, managed in most firms by ordinary controls. It is also why an allegation of this shape lands so hard: it does not require a new capability, only a decision.

We have written before about a fake recovery service that charged victims to retrieve what it never recovered, and about an insider who extorted his own employer. The pattern in all three is the same: the trusted position is the asset.

What to do

  • If you retain an incident response or negotiation firm, ask who inside it will know about your incident, and get the answer in writing before you need it.
  • Ask what the firm's conflict policy is on taking work from both sides of a market, and whether its staff hold outside interests in related companies.
  • Keep breach notification to regulators and insurers on your own timetable, not on the advice of whoever is talking to the attacker.
  • Log who you told and when. If an attacker demonstrates knowledge earlier than your own disclosure trail, that is worth knowing.
  • Nothing here suggests the sector is compromised. It suggests the position is worth protecting, which is a different instruction.

What is not established

  • Whether Dubrovsky is guilty of anything. He is charged, has not been convicted, and is entitled to a defence.
  • The identity of the consulting firm executive, which has not been reported, and whether that person did anything at all. They have not been charged.
  • Whether the Signal messages say what the sources describe. Neither we nor the reporter has seen them.
  • Whether any of the suspicions will become charges.
  • The exact date and place of the arrest. The records are partly sealed.
  • How ShinyHunters obtained the data in any individual case on the Shinywire list.

The court filings were not retrieved for this piece. The charges above are as KrebsOnSecurity describes the records.