FBI Director Kash Patel said on X on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters extortion group, which the bureau blames for the recent FBIJobs.gov incident on a platform run by a third-party vendor. Patel called it the latest of several arrests in a matter of days but did not name the suspect or say where the arrest happened.

The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and regarded as a primary co-conspirator in the intrusion; no name or charges have been made public.

ShinyHunters told BleepingComputer in September that it got in through an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud systems, claiming 2 to 3 TB of data on current and former staff and job applicants; the FBI has since said a contractor-managed platform had not installed a security update, and the Times reports an internal memo assumed every employee was affected.

Earlier actions: Dutch police arrested Pepijn van der Stap ('Umbreon') on 15 September, and Jordan detained Saif al-Din Khader ('Rey'), who sources say is cooperating with the FBI. Primary: FBI Director Patel on X; wire: BleepingComputer.

UPDATE (10 Oct): Politico and KrebsOnSecurity named the man arrested in Pennsylvania as Edward Dubrovsky, 54, a Canadian cybersecurity executive whom Politico and BleepingComputer described as a co-founder of CYPFER and associated with CyberSteward, firms that help breach and ransomware victims negotiate with extortion groups; he was reportedly attending the NetDiligence Cyber Risk Summit. Public court records show he appeared in the Eastern District of Pennsylvania and was transferred in custody to the Eastern District of Texas, where charges were filed.

The complaint is sealed, but the docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort (18 U.S.C. 371 and 1030(a)(7)(B)) and Hobbs Act extortion and conspiracy (18 U.S.C. 1951).

The FBI has not publicly confirmed that Dubrovsky is the suspect Patel described; KrebsOnSecurity cites multiple sources linking the arrest to the ShinyHunters investigation.

The FBI says ShinyHunters and associates breached more than 140 organisations and collected more than US$70 million in extortion payments over the past year. Wire: BleepingComputer (10 Oct).

UPDATE (12 Oct): Reuters (republished by iTnews on 12 October) says the partially sealed court papers filed in the Eastern District of Pennsylvania spell the defendant's surname 'Dobrovsky' or 'Dobrosky' and give no age, profession or employer; a person briefed on the matter told Reuters it is Canadian security executive Edward Dubrovsky.

Reuters says federal prison records show a 54-year-old Edward Dubrovsky currently held at a federal detention centre in Philadelphia.

The FBI referred Reuters to Director Patel's statement and declined further comment, and CyberSteward did not respond.

UPDATE (19 Oct, KrebsOnSecurity): citing two sources close to the investigation, Krebs reports that FBI investigators believe at least one executive at a large US consulting firm with more than 1,000 associates helped operate ShinyHunters' victim-extortion site shinywire[.]com. Krebs does not name the firm or the person because no charges have been filed. The site ran from about 3 May to 16 October 2026 and had pages for nearly 100 breached organisations, each with samples of stolen files and a demand to negotiate; victims who did not respond within seven days had their data published on the group's Tor leak blog.

Sources say Signal messages read when Dutch police arrested Pepijn van der Stap on 15 September showed frequent contact with Dubrovsky and with the US executive, who often knew about new victims before the victims did, and that Dubrovsky knew ShinyHunters had stolen FBI data but did not tell the bureau before the group threatened to publish it. The FBI has not commented and these claims are not in public court records; Dubrovsky's complaint remains sealed.

CYPFER, in a 14 October statement quoted by KrebsOnSecurity, says it learned of his arrest from the media, that to its knowledge it is not a target of any investigation, that its business does not include making or facilitating ransomware payments, and that CyberSteward and CYPFER are separate companies with no officers, directors or employees in common.

KrebsOnSecurity also reports that Daniel Tobok of CYPFER, in a legal dispute with Dubrovsky, said Dubrovsky has misrepresented himself as a CYPFER founder and is not a shareholder.

CORRECTION (21 Oct 2026): this card earlier stated as fact that Dubrovsky co-founded CYPFER and that the firms help victims pay extortion demands; that description comes from Politico and BleepingComputer, and CYPFER disputes it.