PHILADELPHIA — A Canadian cybersecurity executive who specializes in ransomware negotiations has been arrested in the United States and faces federal cyber-extortion allegations, according to court and prison records reviewed by Reuters.

Reuters identified the accused as Edward Dubrovsky, a 54-year-old linked to Richmond Hill, Ontario. Court records contain conflicting spellings of his surname, and the central complaint remains sealed.

The available docket information lists allegations of conspiracy to threaten the confidentiality of information with intent to extort money and interference with commerce by threats. The allegations have not been proven in court.

Connection to a broader FBI operation

FBI Director Kash Patel said Friday that agents had arrested another suspected co-conspirator connected to the ShinyHunters hacking group. Patel did not name the person in his public statement, and the FBI declined to provide Reuters with further details.

Reuters reported that the arrest came amid an international crackdown on ShinyHunters after the group allegedly stole information concerning FBI employees. The news agency linked Dubrovsky to the arrest through court documents, prison records and a person briefed on the case.

Cybersecurity journalist Brian Krebs separately reported that federal records show an Edward Dobrovsky was arrested in Pennsylvania on October 8. Krebs said the limited public docket lists cyber-extortion and conspiracy allegations and that later filings transferred the case to the Eastern District of Texas.

Ransomware negotiator's role

Reuters said Dubrovsky's online professional profile identifies him with CyberSteward, a company that advertises services involving threat-actor engagement, cyber-extortion negotiations and settlement facilitation. Attempts by Reuters to reach Dubrovsky, lawyers associated with the matter and the company were unsuccessful.

Krebs reported that Cypfer, another Canadian cybersecurity company, said Dubrovsky had been a managing director and resigned in November 2025. The company disputed an online description identifying him as a founder or co-founder.

Ransomware negotiators ordinarily work for victim organizations, helping assess criminal claims, communicate with attackers and manage possible settlements. Neither that type of work nor a professional association establishes criminal conduct. The U.S. case concerns the specific allegations in the sealed federal matter.

What remains unknown

The public records reviewed by the news organizations do not disclose the full factual basis for the charges. Reuters also noted discrepancies in the spelling of the accused's name and said prosecutors in Philadelphia did not answer requests for clarification.

No plea or defence response was reported when this article was published. The accused is entitled to the presumption of innocence.

Sources: Reuters, published October 11; Reuters report on the FBI director's statement, October 9; KrebsOnSecurity, published October 9 and updated October 10.

Lead image: FBI headquarters in Washington, photographed by the Federal Bureau of Investigation; public domain. File photo, not an image of the arrest or the accused.