Edward Dubrovsky Faces Sealed Extortion Charges in Texas

Federal agents arrested Canadian ransomware negotiator Edward Dubrovsky, 54, in Pennsylvania on October 8, 2026, on sealed extortion-conspiracy charges now headed to Texas. The public file lists threats to harm the secrecy of computer data for money, not a hacking count, and the complaint that would explain his alleged role is still closed.

That gap is already changing the job. Incident-response firms that sit between victims and extortion crews now have to assume those talks can be charged as conspiracy, because prosecutors used the same statute family this year to jail another negotiator, and this complaint has not been shown to the trade that has to live with it.

Philadelphia Docket Lists Extortion Conspiracy Counts

The case on paper is United States v. Dobrovsky, docket 2:26-mj-01973, in the Eastern District of Pennsylvania, with the last name misspelled. Assistant U.S. Attorney Everett R. Witherell appeared for the government. Magistrate Judge Scott W. Reid handled the first appearance.

The complaint counts, as indexed on the public parties sheet, are conspiracy under 18 U.S.C. 371 together with the computer-extortion ban in federal law, section 1030(a)(7)(B), and Hobbs Act extortion and conspiracy under 18 U.S.C. 1951(a) and (b)(2). Section 1030(a)(7)(B) reaches a communication, sent in interstate or foreign commerce, that threatens to take information from a protected computer without permission or to impair the confidentiality of information already taken, if the aim is money or something else of value. A first computer-extortion count carries up to five years. The Hobbs Act count carries up to 20 years.

THE COUNTS IN PHILADELPHIA

Those are the only offenses the public Pennsylvania file names. There is no published count for breaking into a federal system. Independent journalist Brian Krebs identified the defendant as Dubrovsky on the Friday after the arrest, and Bureau of Prisons records list a 54-year-old Edward Dubrovsky at the Federal Detention Center in Philadelphia, with no release date. Dark-web intelligence firm District 4 Labs, working from electronic wallet records preserved since 2010, places him in Richmond Hill, north of Toronto, at that age.

He Was in Town for a Summit His Old Firm Sponsored

The Cyber Risk Summit ran October 5 to October 7 at the Loews Philadelphia Hotel. Event listings named CYPFER, the Toronto incident-response firm Dubrovsky used to help lead, as a lead sponsor. A LinkedIn post about a month before the arrest said he planned to attend with the CyberSteward team and to keep talking about “compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services.” A company LinkedIn post showed him at the conference signing copies of a book he had just put out.

He was in custody the next day. On the Philadelphia magistrate docket from October 8, the arrest is entered as a Rule 40 pickup, the procedure used when a defendant is caught outside the charging district. Reid appointed the Federal Defenders after a colloquy on money. Dubrovsky stipulated to identity and probable cause, which is not a guilty plea. The government asked that he be held. He chose to take his detention hearing in the charging district, the Eastern District of Texas, and Reid ordered him detained pending that hearing. On October 9 the court committed him to Texas and directed the Marshals Service to move him.

THE WEEK IN PHILADELPHIA

1. October 5 to October 7, 2026: Cyber Risk Summit runs at the Loews Philadelphia Hotel, with CYPFER listed as a lead sponsor.
2. October 8, 2026: Arrest entered; first appearance before Judge Reid; Federal Defenders appointed; detention ordered pending a Texas hearing.
3. October 9, 2026: Commitment order to the Eastern District of Texas; FBI Director Kash Patel announces an unnamed ShinyHunters co-conspirator arrest.

Patel did not give a name, a city, or a role. People familiar with the investigation have said the Canadian taken in Pennsylvania is Dubrovsky and that agents view him as a principal co-conspirator in ShinyHunters’ attack on bureau data. The public docket does not mention ShinyHunters or the FBI jobs site. The Texas complaint remains sealed.

🚨 Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor.

This is the latest arrest…

— FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026

Patel said agents in the field had arrested “another suspected co-conspirator of the ShinyHunters group,” the crew the bureau believes is responsible for the FBIjobs.gov incident on a platform run by a third-party vendor, and that the bureau would keep working with partners “to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”

The FBI Jailed a Negotiator in July

The statutory choice is not new to this beat. On July 9, 2026, a federal judge in the Southern District of Florida imposed a 70-month sentence handed down in Miami on Angelo Martino, 41, of Land O’Lakes, a former ransomware negotiator who pleaded guilty to conspiracy to interfere with interstate commerce by extortion. Court papers in that case said he took pay from BlackCat, also tracked as ALPHV, to hand over clients’ negotiating positions and insurance limits so the crew could push ransoms higher, and that he later joined other former cybersecurity workers in deploying the same strain.

Angelo Martino sold out the very victims he was hired to represent, handing their confidential negotiating positions to BlackCat actors to drive up ransoms and enrich himself.

Brett Leatherman, Assistant Director, FBI Cyber Division, Justice Department announcement, July 9, 2026

Leatherman said the bureau will pursue insiders who enable ransomware crews, not only the people who run the encryptors. Two other former incident responders in that conspiracy, Ryan Goldberg and Kevin Martin, each received four years in April 2026, also on Hobbs Act conspiracy. Dubrovsky has not been convicted of anything, and the public file does not accuse him of selling a client’s playbook. The charging tools are the same family: a threat, a hoped-for payment, and commerce.

Jon DiMaggio, principal at XFIL Cyber, said earlier this year that ransom negotiation still has no structured community of practice, no peer review, and no recognized body to certify or discipline the people who do it. That vacuum is what a sealed complaint fills with fear rather than rules. Firms can read Martino’s judgment. They cannot read Dubrovsky’s affidavit.

What the Jobs Portal Sample Contained

ShinyHunters went public on September 22, 2026, two days before Dubrovsky self-published a 252-page guide titled Cyber Extortion Strategic Response. The group said it got in on the night of September 21 through a previously unknown hole in Oracle PeopleSoft on the FBI’s unclassified jobs stack, then moved into bureau-managed cloud systems. The applicant site at apply.fbijobs.gov was defaced with a banner saying the site had been seized by ShinyHunters.

The crew claimed it took 2 to 3 terabytes covering almost all FBI agents and people who had applied for bureau jobs, and it gave outlets a 5,000-line spreadsheet it described as a slice. Rows that have been described publicly listed names, home addresses, phone numbers, dates of birth, Social Security numbers, emergency contacts, field-office assignments, and, in some lines, work against Chinese spies, Russian intelligence, cartels, cyber crews, surveillance, and human intelligence. The FBI has not confirmed that full haul. People familiar with an internal staff notice said the bureau is operating as if every employee’s personal information was compromised, and that the notice listed names, addresses, work and personal contacts, Social Security numbers, dates of birth, and emergency contacts.

THE PUBLIC HAUL FIGURES

• The sample: A 5,000-line spreadsheet circulated as a slice of the claimed theft, with home and family fields on alleged employees.
• The claim: ShinyHunters said it pulled 2 to 3 terabytes and held data on almost all agents and applicants.
• The bureau’s posture: People familiar with the staff notice said the FBI is treating every employee’s personal information as exposed.
• The group’s ledger: The FBI has said ShinyHunters hit more than 140 organizations and took more than $70 million in extortion payments over the last year.

The group framed the job as coercion, not a classic ransom note. It gave the bureau a week to correct or pull a May warning about ShinyHunters and said the 5,000-line sample would not leak by its hand. FBI Cyber Assistant Director Brett Leatherman later said the incident came from a security failure on a platform managed by a third-party organization, after a contractor did not install a patch that had been issued to secure that platform. The bureau removed that contractor. Patel’s October 9 statement again called the jobs incident a failure on a vendor-run platform.

Dutch police had already arrested a 24-year-old man in Amsterdam in the ShinyHunters investigation. Jordanian authorities detained Saif al-Din Khader, a teenager from Amman who used the alias Rey, around September 28; people familiar with that case said he was cooperating with the FBI to map the rest of the crew. Patel called the Pennsylvania arrest the latest in a matter of days against the same network.

CYPFER Says the Relationship Ended in November

Dubrovsky’s public profile was built on the other side of those chats. A 2022 CYPFER hiring note called him a 30-year veteran with CISSP, OSCP, and PMP credentials and a seat on York University’s cybersecurity advisory board, and quoted him saying clients hit by ransomware “need to get up-and-running as soon as possible.” His LinkedIn page has called him CYPFER’s chief operating officer and an “ex-founder.” On a 2024 industry podcast he described falling into negotiation while doing forensic response, then opening channels with crews to test claims, buy time, and, in some jobs, talk about payment.

The book’s store listing draws the line he wanted the market to hear. “Communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay,” the listing says. “Engagement can serve other objectives, including testing claims, gathering information, creating time, and preserving options while the organization evaluates its next move.” That is the specimen the trade has been selling: talk is intelligence work, and talk is not a wire to the other side.

CYPFER is now drawing a different line. Spokesperson Liz Sweet said Dubrovsky was hired as a consultant in 2022, served as managing director until he resigned in November 2025, and “has had no relationship with CYPFER” since. She said he was never a founder. She said CyberSteward and CYPFER are separate companies with no officers, directors, or employees in common, and that CYPFER “does not” do ransomware payment facilitation. A CYPFER site page still advertises ransomware recovery services CYPFER still sells, and an older page described “strategic negotiation guidance” and “secure payment facilitation” for ransomware clients. Litigation last year identified CyberSteward as a trade name for CYPFER and said the firm helped Fortune 500 clients negotiate and move extortion payments. Those are the public scraps. They do not settle who employed him on the dates in the sealed affidavit.

Incident Responders Now Face the Same Statute

The second-order problem is practical. A negotiator’s job is to send messages to people who are, by definition, threatening to wreck the confidentiality of stolen files unless they are paid. That is close to the words in 1030(a)(7)(B). When the complaint is sealed, counsel for every other shop has to guess whether prosecutors think the crime was joining the threat, steering a payment, passing a channel, or something that never appears in a standard retainer.

WHAT WE KNOW

• The paper charges: Extortion conspiracy and Hobbs Act counts in a Pennsylvania Rule 40 file, with Texas as the charging district.
• The custody path: Arrested October 8, stipulated to identity and probable cause, ordered held for a Texas detention hearing, listed at the Philadelphia detention center.
• The July template: Martino’s 70-month Hobbs Act conspiracy sentence for a negotiator who fed client positions to BlackCat.

WHAT IS UNCONFIRMED

• The FBI jobs role: Not named in the public docket; asserted by people familiar with the investigation and left unnamed in Patel’s post.
• The conduct: The sealed complaint has not been quoted, so the alleged acts, dates, and systems are not in the open record.
• The employer on the relevant dates: CYPFER says the tie ended in November 2025; LinkedIn and older case papers describe a longer, messier overlap with CyberSteward.

Shops that still take these jobs now have to treat attacker chats, wallet hops, and “settlement” wires as evidence they may one day explain to a grand jury. Victim companies that used to hand the whole channel to a vendor have a reason to keep the messages, the approvals, and the payment decision in-house. Insurers that used to want proof every option short of payment was exhausted now have to ask who was in the chat and who got paid to be there. None of that requires Dubrovsky to be guilty. It only requires the statutes on the Philadelphia sheet and a complaint nobody outside the case can read.

Reid’s transfer order puts the next public fight in the Eastern District of Texas, where people familiar with the investigation have said the ShinyHunters file is being run. Until that complaint is unsealed, the working rule for the rest of the trade is the one Leatherman already put on the record in July, and the one the docket put on Dubrovsky in October: talking to an extortion crew is now a fact pattern federal prosecutors know how to charge.

Disclaimer: This article is news reporting and analysis of public court records, official statements, and named spokespeople. It is informational only and is not legal advice, a finding of guilt, or a recommendation about ransomware payments, incident-response retainers, or criminal defense. Readers who face a live extortion incident, a federal inquiry, or a charging decision should consult a qualified criminal-defense lawyer and, where payments or sanctions risk are in play, qualified sanctions counsel before acting. Figures, custody status, and case posture reflect the public sources cited here and can change as sealed filings open, hearings are held, or charges are added or dropped.