Ransomware
A negotiator's arrest: check what your IR vendors hold
A Canadian ransomware negotiator was arrested in the ShinyHunters probe. What is on the record, and how to limit what negotiators and IR vendors can see and touch.
Edward Dubrovsky, a 54-year-old Canadian cyber security executive who negotiated with ransomware gangs on behalf of victims, was arrested in the Philadelphia area on Thursday, October 8, according to federal court records reported by Reuters and CyberScoop. Records in the Eastern District of Pennsylvania list two charges: conspiracy to threaten the confidentiality of information to extort money, and interference with commerce by extortion under the Hobbs Act. The complaint itself is sealed in the Eastern District of Texas, so what he is accused of doing has not been made public. These are allegations; he has not been convicted, and he did not respond to CyberScoop's request for comment.
The case matters to defenders because of who he is. The New York Times, in a report carried by the Boston Globe, cited two people familiar with the matter who said federal authorities consider him a primary co-conspirator in the ShinyHunters attack on FBI data. The FBI has not confirmed that he is the person Director Kash Patel described when he announced an unnamed arrest on October 9. Whatever the court finds, negotiators and the incident response (IR) vendors who work alongside them hold a victim's most sensitive facts and access in one place.
What is on the record
Court records are the firmest part of the story. The docket spells his name "Dobrovsky." On the day of the arrest, prosecutors asked for detention and a judge ordered him held pending a detention hearing in Texas. A second order on Friday, October 9, directed the US Marshals Service to transport him there. The Federal Bureau of Prisons locator lists him at the Federal Detention Center in Philadelphia. The charges listed concern extortion threats; the public docket does not show a charge for unauthorized access to a computer.
Patel's post on X said: "Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group." He named no one. KrebsOnSecurity identified Dubrovsky on the evening of October 9, citing sources who tied the arrest to the ShinyHunters investigation. Reports put him in Philadelphia for the NetDiligence Cyber Risk Summit, which his LinkedIn said he planned to attend.
His employment history is disputed. His LinkedIn described him as chief operating officer and a former founder of CYPFER, a Canadian firm that helps organisations recover from and negotiate in ransomware cases, and it also referenced CyberSteward, a Toronto firm that advertises threat actor negotiation and settlement services. A firm representing CYPFER told CyberScoop he was a managing director from May 2022 to December 2025, was never a founder, and has had no role there since. Other reports quote CYPFER as saying he resigned in November 2025, so the end date differs between sources.
ShinyHunters claimed the FBI breach on September 22, and this arrest follows the Dutch arrest and the Jordanian detention we covered in our post on Rey. The breach itself started at a third-party platform where a contractor had not installed a patch, according to the FBI's Brett Leatherman; Reuters and Nextgov report the contractor worked for Accenture.
Why a negotiator is a high-value insider
During a ransomware or data extortion case, the negotiator usually learns things the attacker would pay for: how much the victim can pay, whether backups worked, how much pressure the board is under, the deadlines that matter, and the limit on the cyber insurance policy. An attacker who knows the insurance limit can set the demand at that figure and refuse to move.
That risk is documented in a closed case. In July 2026, Angelo Martino, a former negotiator at incident response firm DigitalMint, was sentenced to 70 months in prison after pleading guilty to conspiring to interfere with commerce by extortion. Prosecutors said that from April 2023 he passed BlackCat operators victims' negotiating positions, insurance limits and internal assessments, which helped the group raise demands against five organisations, and that he later took part in attacks himself. Two co-defendants, DigitalMint negotiator Kevin Martin and Sygnia incident response manager Ryan Goldberg, each received 48 months.
IR firms often hold more than the negotiator does: domain admin credentials, accounts in your identity provider, a live response session on every endpoint through your EDR (endpoint detection and response) console, and copies of the stolen data for analysis. Those accounts tend to be created in a hurry on the first night and left active for months.
What to do before the next incident
- Know who will negotiate for you. If your insurer assigns a negotiator from its panel, get the panel list now, ask the carrier how it vets those firms, and ask whether you can bring a firm you have checked yourself. Retaining the firm through outside counsel gives you a party whose duty runs to you and who can oversee the negotiator.
- Write the data terms into the retainer. Require that client data stays on systems you approve, that subcontractors are disclosed, that all messages with the threat actor are logged and handed to you, and that copies are deleted or returned with a written confirmation when the engagement closes.
- Decide what the negotiator is told. Give a payment authority ceiling, approved by your executives, and keep the policy documents and coverage limit with counsel and the insurer.
- Prepare vendor accounts in advance. In Microsoft Entra ID, create a security group for incident vendors, cover it with a Conditional Access policy that requires MFA (multi-factor authentication), and assign admin roles to its members as eligible in Privileged Identity Management with an assignment end date, so access expires on its own. Avoid sending shared admin passwords over chat.
- Scope EDR access. In Microsoft Defender XDR, give vendor accounts a custom role under Settings, Endpoints, Roles, and grant advanced live response (which lets the holder upload and run scripts on devices and pull files from them) only to the named responders who need it.
During and after an incident
Keep your own record of the negotiation. Have a member of your team log in to the attacker's chat portal alongside the negotiator, or require daily exports of the full transcript, and have someone outside the negotiating firm read it. A channel that only the negotiator can see is a warning sign.
Check the payment details yourself. Your own staff should read the wallet address from the attacker's portal and compare it with the one in the vendor's payment request, and record the transaction hash once paid. Our post on the MonsterCloud charges covers invoice terms and sanctions screening for recovery vendors.
At close, work through this list:
- Export the Entra ID sign-in and audit logs for every vendor account (Monitoring and health, Sign-in logs, filtered by user) and keep them with the incident record.
- Disable those accounts and remove PIM eligibility.
- Rotate every credential the vendor saw or was given, including service accounts and the krbtgt account (reset twice) if domain admin access was shared.
- Uninstall forensic and remote access agents the vendor deployed, and confirm they are gone in your software inventory.
- Get the written deletion or return confirmation from the retainer.
If a negotiator who has since been charged worked on one of your incidents, pull the engagement file, the transcripts and the payment records, confirm every account they used is disabled, and talk to counsel about whether to contact the FBI. Nothing published so far says any client's data was misused in this case, and the complaint remains sealed.
Our security operations team can sit on your side during an incident and review what outside vendors see and do, and our compliance and audit readiness work covers retainer terms and vendor access policies. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: CyberScoop, BleepingComputer, Fox 9, with Reuters, The Boston Globe, from The New York Times, Nextgov, SecurityWeek, SecureWorld, Help Net Security on the Martino sentence, BleepingComputer on the Martin and Goldberg sentences.