After the Arrest: What Dubrovsky Changes

Last week I wrote that the ransom business was built to leak. Three weeks after the FBI arrested Ed Dubrovsky, the reporting has filled in, and it's worse than the arrest alone suggested.

The attackers already told us who the problem was

Start with the line that should stop every board cold. In private Telegram chats from this spring, the ShinyHunters operator complained that most of his victims would have paid if Coveware hadn't talked them out of it. He called Coveware the problem he was trying to "eliminate." KrebsOnSecurity published the screenshots.

Read that again. The extortion crew's biggest business threat wasn't the FBI. It was a response firm telling victims not to pay.

So who did they get along with? That's the question this case is answering.

What we know now

The facts first, because this is a criminal case and he's presumed innocent.

Dubrovsky was arrested in Pennsylvania on October 8, in town for a cyber risk event. The complaint was filed in the Eastern District of Texas, which sources describe as the hub of the FBI's ShinyHunters probe. It's sealed. The charges listed on the docket are conspiracy to threaten the confidentiality of information to extort money, Hobbs Act extortion, and conspiracy to commit Hobbs Act extortion, per Gizmodo's read of the court records. A judge ordered him held pending a detention hearing in Texas. No plea. Nothing proven.

Now the allegations, all from sources talking to Krebs, none tested in court:

When Dutch police grabbed suspected ShinyHunters leader Pepijn van der Stap on September 15, he was logged into Signal. His chats showed regular contact with Dubrovsky and with an executive at a large U.S. consulting firm.

Those negotiators reportedly knew about new ShinyHunters victims before the victims did.

Investigators believe Dubrovsky knew ShinyHunters had stolen FBI personnel files and didn't tell the bureau before the gang went public with threats.

At least one executive at that U.S. firm, described as a prestigious shop with 1,000+ associates, allegedly helped run Shinywire, the extortion site that listed close to 100 victims between May and mid-October and pushed each one to start talking terms. Not named. Not charged.

Meanwhile "Rey," the Jordanian teenager who took over the ShinyHunters brand, was detained in early October and is reportedly cooperating with the FBI. Krebs's sources say more people in the negotiation business may be charged.

In Canada the fallout is personal. Dubrovsky and his former partner at Cypfer, Daniel Tobok, have been suing each other in Ontario since their split. Cypfer says it doesn't facilitate ransom payments, hasn't heard from law enforcement, and has nothing to do with CyberSteward, the firm Dubrovsky launched in late 2025. Hamilton, which hired Cypfer after its 2024 attack, got a statement from the firm that Dubrovsky never touched the city's file. Expect a lot more of those letters.

What the last three weeks confirmed

My argument last week was simple. When the people paid to help a victim earn more as the ransom goes up, the incentives point at the attacker. The new reporting doesn't just support that. It's coming from the insurance side now.

Mark Camillo runs CyberAcuView, a group founded by major cyber insurance carriers. He told Krebs that negotiators charging a percentage of the final payment "makes no sense" and that nobody in the chain should profit from the size of the ransom. That's the insurers' own consortium saying it out loud. Took them long enough.

The second point was that deletion promises are worthless. PowerSchool paid ShinyHunters $2.85 million in late 2024, with CyberSteward assisting according to PowerSchool's own FAQ. By May 2025, school districts were getting fresh extortion demands built on the same stolen records. Nobody has tied that second wave to ShinyHunters. Doesn't matter. You paid for a promise you could never verify, and the data walked anyway.

The third point was about who gets hired. Insurers steer victims to approved firms. Firms that won't pay get swapped out once the victim decides to pay. Now look at who the attackers were complaining about: the shops that tell people not to pay. Look at who they were allegedly chatting with on Signal: people who knew about breaches before the victims did.

One honest caveat. We haven't seen the complaint. It's possible the evidence is narrower than the leaks suggest, and Dubrovsky deserves his day in court. But the structural problem doesn't depend on how his case ends. Martino, Pinhasi, and now this. Different firms, same shape.

That's not a few bad apples. That's the orchard.

What to change before your next incident

You don't need to wait for Texas. If you're a board, a CISO, an MSP or a broker, here's what I'd do this quarter.

1. Ask how your negotiator gets paid. In writing. Flat fee or percentage. If it's a percentage of the ransom, walk.

2. Separate advice from payment. The firm telling you whether to pay should not be the firm that profits when you do.

3. Check your panel. Find out which response firms your insurer will send you to, and whether any of them have refused to facilitate payments. Ask the broker what happens if you don't want to pay.

4. Assume a leak. If your negotiator could be talking to the other side, your insurance limit, your board's appetite and your deadline are all on the table. Share them on a need-to-know basis, even with your own advisors.

5. Take "we deleted it" off the list of reasons to pay. PowerSchool proved that promise is worth nothing.

6. Pre-vet now. Pick your IR and negotiation partners before you need them, and check references the way you'd check a vendor with your domain admin password. Because that's what they are.

And if you've worked with any firm named in this case, don't panic. Ask them directly who touched your file and how fees were calculated. Hamilton did. You can too.

Bottom line

The ransom economy runs on trust between people who should never trust each other. Victims trust negotiators. Insurers trust panels. Everyone trusts that the person on the call is on their side.

This case shows how cheap that trust has been. The fix isn't a new law or a new vendor. It's asking who profits when you pay, and refusing to hire anyone whose answer is "me."

I'll keep following the Texas docket. If the complaint unseals, there'll be a part three.