The Job Is to Be the Calm Voice When Everything Is on Fire
When a company gets hit with ransomware, the first call often goes to a lawyer. The second call goes to a negotiator, someone whose entire job is to sit down with criminals, figure out what they actually want, and talk the price down without getting anyone hurt in the process. It is a strange profession that exists because a stranger one came first: an entire economy of professional extortion that most companies have no idea how to deal with on their own. Edward Dubrovsky built a career inside that strange profession. He co founded Cypfer, a Canadian firm that negotiates with ransomware gangs on behalf of victim companies, and more recently helped start a second firm called CyberSteward. On October 8, 2026, federal agents arrested him in Pennsylvania.
An Arrest at an Industry Conference
The detail that makes this story hard to look away from is where it happened. Dubrovsky was not picked up at home or pulled over on his way to work. According to reporting from Krebs on Security, he was arrested while attending the Cyber Risk Summit in Philadelphia, an industry conference built around exactly the kind of work he did for a living. Court records show the case was filed in the Eastern District of Pennsylvania on October 8 and transferred the following day to the Eastern District of Texas, where Dubrovsky is being held pending a detention hearing after prosecutors successfully argued for his continued custody.
The charges reported by Krebs on Security include conspiracy to threaten to impair the confidentiality of data with intent to extort money, interference with commerce by threats, and related cyber extortion and conspiracy counts. As of this writing, the complete criminal complaint and the full scope of what prosecutors allege Dubrovsky actually did have not been made fully public, and outlets covering the story have been careful to note that key details are still emerging. What is already public is enough to make the story worth paying close attention to.
The Irony Nobody Could Have Scripted Better
Dubrovsky is the author of a book called Cyber Extortion Strategic Response, in which he draws a careful line between what he calls communicating with a criminal and negotiating a payment, a distinction that matters enormously to a profession that has spent years trying to convince the public it operates on the right side of a very blurry ethical line. Months before his arrest, he posted on LinkedIn that he was looking forward to continuing conversations around what he described as strategy and compliance driven coercive advisory and negotiations.
Read that sentence again knowing what came next, and it lands differently. Ransomware negotiation has always asked for a strange kind of trust. A victim company, already in the worst week of its corporate life, is asked to hand the keys to the conversation to someone who promises they are working for the victim and only the victim, while also maintaining whatever relationships and channels let them talk to criminals fluently enough to get a deal done. That arrangement depends entirely on the negotiator actually being on the side they claim to be on. Federal prosecutors are now alleging that, in at least this case, they were not.
Where This Fits Inside the ShinyHunters Investigation
Dubrovsky's arrest is the third made public in the FBI's investigation into ShinyHunters, the extortion group that claimed last month to have breached the bureau's own job application portal, FBIJobs.gov, and stolen sensitive data on nearly every FBI agent and applicant on file. The FBI says ShinyHunters has extorted more than seventy million dollars from victims so far this year alone, a figure that gives some sense of why an industry of professional negotiators exists in the first place.
The arrests so far, in the order they became public, read like a map of how wide this investigation has already spread:
- Pepijn van der Stap, a 24-year-old from Amsterdam identified as an alleged leader of the group, was taken into custody by Dutch police, with the arrest becoming public on September 15.
- Saif al Din Khader, who goes by the handle Rey, was detained in Jordan on September 29 and is reportedly cooperating with the FBI as it works to identify other members of the group.
- Edward Dubrovsky, arrested in Pennsylvania on October 8, is the first suspect connected not to carrying out the breach itself but to the negotiation economy that exists around incidents like it.
That progression matters. The first two arrests fit the pattern readers would expect: alleged hackers, caught through alleged hacking. The third does not fit that pattern at all, and that is exactly what makes it worth a second look.
The FBI Finally Named What Actually Went Wrong
When we covered the initial FBIJobs.gov breach last month, the bureau had not yet said whether the point of entry was its own system or a vendor's. That uncertainty has since been resolved. Investigators have determined the breach traces back to a security patch that was explicitly issued to secure the underlying platform, Oracle's PeopleSoft human resources software, and that a contractor responsible for maintaining the system failed to apply it. Reporting has identified that contractor as Accenture, which the FBI has since removed from the project.
A missed patch on contracted HR software is an unglamorous root cause for a breach this damaging, and that is precisely the point worth sitting with. Nearly every major incident covered on this blog eventually traces back to something similarly ordinary: an unpatched appliance, an over trusted API, a vendor nobody double checked. The FBI is one of the best resourced investigative agencies on the planet, and the hole that let ShinyHunters in still came down to a contractor who did not finish a job that had already been assigned to them.
What This Means If Your Company Keeps a Negotiator on Retainer
Most businesses will never need to personally evaluate a ransomware negotiator, and that is exactly the problem. The entire category of incident response vendor, negotiators, breach coaches, forensic firms brought in after something has already gone wrong, gets chosen under enormous time pressure, usually during the worst week a company has ever had, often on a referral from a cyber insurance policy that already has a preferred vendor list. Almost nobody does the kind of background diligence on an incident response vendor that they would do before signing a long term enterprise software contract, because there is rarely time to.
That is worth changing before a crisis forces the decision for you. Vet incident response and negotiation vendors the way you would vet any partner who will have direct access to your most sensitive information during your most vulnerable moment, before you actually need one. Ask who they have worked with, ask how their engagements are structured, and ask the uncomfortable question directly: what stops a negotiator's financial incentives from quietly bending toward the outcome that benefits the negotiator rather than the client. A profession built entirely on trust should be able to answer that question without flinching.
At AetherGuard Technologies, incident response planning, including vetting exactly the kind of third party vendors a company will lean on during a live breach, is something we help clients work through before the crisis hits, not during it, because the worst possible time to evaluate who deserves your trust is the week you most desperately need somewhere to put it.
