The Ransom Business Was Built to Leak

The person you hire to talk to your extortionist knows everything. Your insurance limit. Whether your backups survived. How badly the board wants this to go away. The exact hour your operations start bleeding money.

That's the job.

Now think about who else would pay for that information.

The arrests nobody in our industry wanted to see

On October 8, the FBI arrested Edward Dubrovsky in Pennsylvania. He's a Canadian ransomware negotiator, a familiar face on the conference circuit, and he was in town for a cyber insurance event in Philadelphia, according to SecurityWeek. Court records show he's charged with threatening to disclose stolen data and with extortion affecting interstate commerce. He also recently published a book on cyber extortion that recommends always engaging with the attackers.

He's presumed innocent. Nothing has been proven in court. Plenty of people in Canadian security know him, and the reaction here has been shock more than anything.

But the allegations deserve a slow read. When Dutch police arrested suspected ShinyHunters member Pepijn van der Stap on September 15, he was logged into Signal. KrebsOnSecurity reports his chats showed frequent contact with ransomware negotiators in Canada and the U.S., and that those negotiators often knew about new ShinyHunters victims before the victims did. Investigators also reportedly believe an executive at a large U.S. consulting firm helped run Shinywire, the extortion site that listed close to 100 victims and pushed each one to start talking terms. That person hasn't been charged or named.

Sit with that for a second. People on the "help" side of the table allegedly knew about the breach before the breached company did.

One bad apple? Count the crates.

In July, former DigitalMint negotiator Angelo Martino got 70 months in prison for feeding BlackCat his own clients' negotiating positions, including their insurance limits. His colleague Kevin Martin and a Sygnia incident response manager, Ryan Goldberg, pleaded guilty to deploying BlackCat themselves.

On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud. Prosecutors say he told customers he'd recover their systems without paying, then quietly paid the attackers anyway. About $8 million out to ransomware crews. About $19 million billed to clients.

Different firms. Different gangs. Same shape every time. Someone with privileged access to a victim's worst day either sold that access or used it.

When the same failure keeps showing up in different places, you stop blaming the people and start looking at the design.

The incentives point the wrong way

Most victims don't pick their negotiator. The insurer hands over a panel and a firm gets assigned. And as Krebs points out, firms that won't facilitate payments get swapped out the moment a victim decides to pay, replaced by firms that will. I've watched that happen for years. The market quietly selects for whoever is most comfortable moving money to criminals.

Then there's the fee. Mark Camillo, who runs the insurer-backed group CyberAcuView, told Krebs that many payment facilitators take a percentage of the final ransom, and that it isn't always disclosed. If you negotiate and also take a cut of the payment, your income goes up when the number goes up. Camillo called that an inherent conflict of interest. I'd call it a business model.

Picture that anywhere else. A lawyer who earns more when you lose a bigger settlement. A mechanic who gets a bonus when your repair bill climbs. Nobody would design that on purpose. We built it anyway, one engagement at a time, because it was convenient and it closed incidents fast.

You're buying a promise from a thief

The other flaw is what the payment actually buys. With encryption, you at least get a key you can test. With data theft, which is ShinyHunters' entire play, you get a pinky swear that the files are gone.

PowerSchool reportedly paid ShinyHunters about $2.85 million after the theft of data on 62 million students and 9.5 million teachers across the U.S. and Canada, with CyberSteward assisting. Months later, individual school districts started getting their own ransom demands built on samples of the same stolen files. Nobody has alleged ShinyHunters ran that second wave. Doesn't matter. The data was still out there after the money moved.

You can't verify deletion. Not partially. Not at all. The FBI told victims in May not to pay ShinyHunters. Coveware and Unit 221B have said the same for a long time, and the group hated them for it. In chats shared with Krebs, ShinyHunters' main account complained that Coveware was wrecking its payment rate.

That's the tell.

The criminals' revenue depends on our side of the industry nudging victims toward the table. When responders tell victims the truth, the criminals lose money.

What I've seen from the room

I've worked more than 600 incident response engagements over 26 years. Most negotiators I've met are honest people doing a grim job. Some have kept hospitals running and payroll going out. Sometimes paying is the least bad option, and I won't pretend otherwise.

I've also had the offer made to me directly. During one negotiation, the attacker pitched me a side deal: get the payment over $2 million and 25% of it was mine. Half a million dollars, minimum, for pushing my own client to pay more.

I said no, and I reported the offer to the client. They deserved to know the person across the table was trying to buy their negotiator.

Not everyone would make that call. Nobody would ever have known.

That one message is the whole problem. The attacker knew exactly who to bribe, because the negotiator is the one person in the room who can move the number. And if the firm is already billing a percentage of the ransom, the attacker isn't creating a new incentive. They're just topping one up.

I've also watched the pressure to pay show up in the first hour, before anyone knows what was taken, dressed up as expertise. Engage early. Keep them talking. Protect the relationship. That advice sounds measured. It's also the advice that keeps the whole machine funded.

Mandiant told Krebs ShinyHunters was on track for nearly $100 million in extortion payments in 2026. Money like that doesn't come from panicked victims acting alone. It comes from an ecosystem that makes paying feel normal, fast and professionally managed.

What has to change

None of this needs new technology. It needs the people paying the bills, insurers and boards, to stop tolerating the conflicts.

• Kill percentage-of-ransom fees. Flat fee or hourly. If your negotiator makes more when you pay more, fire them.

• Split negotiation from payment. Whoever advises whether and how much to pay shouldn't be the one moving the crypto and earning on the spread.

• Disclose every dollar. Every fee, every exchange margin, every hop between your account and the attacker's wallet, in writing, before the engagement starts.

• Vet negotiators like domain admins. They hold more sensitive information about your incident than anyone in the building. Background checks, signed conflict declarations, audited comms.

• Insurers own their panels. If you route a client to a firm, you're vouching for it. Act like it.

• Stop paying for deletion. Paying for a working decryption key is a business decision. Paying a data thief to forget is a donation.

Right now anyone can hang out a shingle as a ransomware negotiator and start running a hospital's worst week. We license electricians.

Bottom line

The ShinyHunters arrests will get framed as a handful of compromised individuals. Some of them may walk. The courts will sort that out.

The model is still broken. We built an industry where the people closest to the victim earn more when the victim pays more, where firms that refuse to pay get replaced, and where the product is a promise nobody can check. Then we act surprised when criminals end up on the payroll.

Fix the incentives, or stop calling it incident response. For too many firms, it's just collections.