Canadian Ransomware Negotiator Arrested in FBI’s ShinyHunters Probe
A 54-year-old Canadian ransomware negotiation expert, Edward Dobrovsky, has been arrested and charged with cyber conspiracy and extortion as part of the FBI’s investigation into the ShinyHunters cybercrime group. Dobrovsky, formerly the COO of Toronto-based incident response firm Cypfer, was detained last week in Philadelphia while attending a cyber insurance conference.
According to court documents, he faces charges of conspiring to threaten data confidentiality with intent to extort and interfering with commerce through threats. His arrest follows the FBI’s recent crackdown on ShinyHunters, which allegedly breached the agency’s systems via a third-party vendor, stealing over two terabytes of employee data. The group exploited a vulnerability in the FBI’s Oracle PeopleSoft software before accessing its AWS GovCloud environment.
Dobrovsky, who claims to have managed over 11,000 cybersecurity incidents, was ordered relocated to Texas, where the FBI’s ShinyHunters investigation is headquartered. Other recent arrests tied to the group include Jordanian national Saif al-Din Khader, 16, and Dutch citizen Pepijn van der Stap, 24.
The FBI has faced scrutiny since the breach, with reports indicating an Accenture contractor was removed for failing to patch the compromised PeopleSoft system. Dobrovsky’s arrest is the latest in a series of legal actions against cybersecurity professionals linked to ransomware schemes, including the indictment of Florida-based MonsterCloud CEO Zohar Pinhasi for allegedly defrauding victims by overcharging for ransom payments.
Source: https://www.bankinfosecurity.com/canadian-ransomware-negotiator-arrested-in-fbi-breach-probe-a-33071
Oracle Canada cybersecurity rating report: https://www.rankiteo.com/company/oracle-canada
"id": "ORA1791824837",
"linkid": "oracle-canada",
"type": "Vulnerability",
"date": "11/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Law Enforcement',
'location': 'United States',
'name': 'FBI',
'type': 'Government Agency'},
{'industry': 'Consulting/IT Services',
'name': 'Accenture (contractor)',
'type': 'Third-party Vendor'}],
'attack_vector': 'Third-party vendor exploitation, Vulnerability in Oracle '
'PeopleSoft software',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Likely (employee '
'data)',
'sensitivity_of_data': 'High (government employee data)',
'type_of_data_compromised': 'Employee data'},
'description': 'A 54-year-old Canadian ransomware negotiation expert, Edward '
'Dobrovsky, has been arrested and charged with cyber '
'conspiracy and extortion as part of the FBI’s investigation '
'into the ShinyHunters cybercrime group. Dobrovsky, formerly '
'the COO of Toronto-based incident response firm Cypfer, was '
'detained last week in Philadelphia while attending a cyber '
'insurance conference. According to court documents, he faces '
'charges of conspiring to threaten data confidentiality with '
'intent to extort and interfering with commerce through '
'threats.',
'impact': {'brand_reputation_impact': 'Scrutiny and reputational damage to '
'FBI',
'data_compromised': 'Over 2 terabytes of employee data',
'legal_liabilities': 'Charges of cyber conspiracy and extortion',
'systems_affected': 'FBI’s Oracle PeopleSoft, AWS GovCloud '
'environment'},
'initial_access_broker': {'entry_point': 'Third-party vendor (Accenture '
'contractor)',
'high_value_targets': 'FBI’s Oracle PeopleSoft and '
'AWS GovCloud'},
'investigation_status': 'Ongoing',
'motivation': 'Extortion, Financial gain',
'post_incident_analysis': {'corrective_actions': 'Removal of Accenture '
'contractor',
'root_causes': 'Unpatched Oracle PeopleSoft '
'system, Third-party vendor '
'exploitation'},
'ransomware': {'data_exfiltration': 'Yes'},
'references': [{'source': 'Court documents'}],
'regulatory_compliance': {'legal_actions': 'Charges of cyber conspiracy and '
'extortion'},
'response': {'law_enforcement_notified': 'FBI investigation',
'remediation_measures': 'Removal of Accenture contractor'},
'threat_actor': 'ShinyHunters',
'title': 'Canadian Ransomware Negotiator Arrested in FBI’s ShinyHunters Probe',
'type': 'Ransomware, Data Breach, Cyber Extortion',
'vulnerability_exploited': 'Unpatched Oracle PeopleSoft system'}