Feds Suspect Negotiator Ran ShinyHunters Site

FBI investigators believe an executive at a U.S. consulting firm with more than 1,000 associates helped operate the ShinyHunters extortion site Shinywire, KrebsonSecurity reported.

The now-defunct site ran from approximately to October 16. It listed entries for nearly 100 organizations. Each entry posted samples of stolen files and urged victims to pay.

The group has extorted more than $70 million from victims so far this year, according to the FBI. ShinyHunters breached the FBI recruitment site fbijobs.gov in late September and threatened to publish medical records, psychological records, Social Security numbers and home addresses.

Investigators tied the negotiator link to the September 15 arrest of Pepijn van der Stap in the Netherlands, per KrebsonSecurity. Dutch police used flash-bang grenades and seized his Signal account while he was logged in. Messages showed frequent contact with ransomware negotiators in Canada and the United States.

Mark Camillo, chief executive at CyberAcuView, an industry group founded in 2021 by major cyber insurers, said firms that take a percentage of the ransom have an inherent conflict because they are financially incentivized to negotiate and pay out.

The Canadian contact was identified as Edward Dubrovsky, 54. The FBI arrested Dubrovsky on October 9, according to court records cited by KrebsonSecurity. He faces charges of threatening to disclose hacked data and interfering with interstate commerce through extortion. Prosecutors asked that he remain in custody and that records stay under seal, Politico reported.

Van der Stap's messages showed Dubrovsky and at least one U.S. executive often knew details about new ShinyHunters victims before victims learned of the breach, KrebsonSecurity reported. One source said Dubrovsky knew ShinyHunters had stolen sensitive FBI data and did not notify the bureau before the group threatened to publish it on X.

Shinywire pushed victims to engage within seven days. If they refused, stolen data moved to a Tor shaming blog. A cached listing cited by KrebsonSecurity targeted Intuitive Surgical after a March 2026 phishing compromise.

Incident response workflows now face a concrete audit point. Insurers typically direct victims to an approved response firm. Some firms refuse to facilitate payments. Others charge a percentage of the ransom. CyberAcuView's warning puts that fee model under direct scrutiny.

PowerSchool illustrates the risk. ShinyHunters stole data on 62 million students and 9.5 million teachers in December 2024, per KrebsonSecurity. PowerSchool paid a $2.85 million demand with help from CyberSteward, according to a breach FAQ cited by KrebsonSecurity. By May 2025 districts received fresh extortion demands using the same data.

The limitation is legal. Paying ransom is not illegal in the United States unless the recipient is sanctioned by the Treasury, KrebsonSecurity noted. ShinyHunters is not sanctioned. That leaves victims and insurers to enforce controls contractually.

No charges have been filed against the U.S. consulting executive. KrebsonSecurity said it is withholding the firm and executive names. The next public marker is Dubrovsky's detention hearing and any unsealing of his case records.