TL;DR
FBI investigators suspect at least one executive at an unnamed U.S. consulting firm helped operate ShinyWire, a now-defunct website used to pressure ShinyHunters victims to negotiate, according to KrebsOnSecurity. The report also describes messages linking the site’s suspected operators to Canadian negotiator Edward Dubrovsky, who was arrested and charged; the unnamed executive has not been charged, and the allegations have not been tested in court.
Federal investigators suspect that at least one executive at an unnamed U.S. consulting firm helped operate ShinyWire, a now-defunct website that published ShinyHunters victim listings and pressed organizations to negotiate, according to an October report by KrebsOnSecurity. The suspected executive has not been publicly named or charged, and the allegation remains an investigative finding, not a court-established fact.
KrebsOnSecurity said two sources close to the investigation described the FBI’s suspicion about the consulting-firm executive. The outlet did not identify the company, which it described as a prestigious U.S. firm with more than 1,000 associates, because the suspected executive or executives had not been charged. The report does not specify what evidence investigators have beyond communications described by its sources.
The site, shinywire[.]com, was active from approximately May 3 through October 16, 2026, and listed nearly 100 organizations that ShinyHunters had allegedly hacked. Its pages urged targets to contact the group to discuss payment, displayed samples of stolen material and threatened publication if victims did not engage. KrebsOnSecurity reported that after seven days, data could be posted on the group’s separate victim-shaming site, which is accessible through Tor.
The report connects the inquiry to messages recovered from the Signal account of Dutch hacker and ShinyHunters suspect Pepijn van der Stap, arrested in the Netherlands on September 15. According to KrebsOnSecurity’s sources, the messages showed frequent contact with Canadian cybersecurity executive Edward Dubrovsky and at least one U.S. consulting-firm executive. The report says investigators believe the contacts sometimes knew about victims before the organizations themselves learned of a breach. These descriptions are attributed to sources close to the probe and have not been established at trial.
Why ShinyWire’s Role Matters
The reported suspicion points to a possible connection between ransomware negotiation services and the infrastructure used to extort victims. Negotiators may be hired by organizations to communicate with attackers, but the allegation here is more serious: that an executive may have helped operate a site supporting the attackers’ pressure campaign. If substantiated, that could raise questions about conflicts of interest, client confidentiality and whether information about breaches was shared with criminals.
The investigation also has added weight because ShinyHunters claimed responsibility for stealing sensitive information from the FBI’s recruitment website in late September. The stolen material reportedly included personal and employment records. KrebsOnSecurity says sources told it that Dubrovsky knew about the FBI data theft before the group threatened to publish the files and did not alert the bureau. That claim is not presented as a court finding. The FBI has not publicly confirmed the full scope of the alleged connections in the material provided.
For organizations facing extortion, the allegations underline the stakes of choosing outside advisers and the need to handle incident information carefully. They do not establish that negotiation firms generally collaborate with cybercriminals, nor do they show that any particular victim’s data was exposed through a negotiator.
cybersecurity threat detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Van der Stap’s Arrest to ShinyWire
ShinyHunters has claimed responsibility for major data breaches since 2019. The group’s membership and leadership have changed over time; KrebsOnSecurity reported that a figure known as “Rey,” identified by the outlet as a teenage hacker from Amman, Jordan, assumed control after earlier members were arrested or jailed. Reuters reported on October 3 that Jordanian authorities had detained Rey and that he was cooperating with the FBI. Those details are attributed to the respective reports.
Van der Stap’s arrest in the Netherlands appears to have become a key step in the current inquiry. KrebsOnSecurity said he was logged into online accounts when authorities arrested him, including Signal, giving investigators access to recent communications. The outlet’s sources described those messages as central to identifying contacts and investigating a separate alleged murder-for-hire plot. Dutch outlet RTL reported that the proposed killings were allegedly to take place abroad; the source material says there is no indication they were carried out.
On October 9, KrebsOnSecurity reported that the FBI arrested Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters investigation. Court records cited by the outlet say he was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. Politico reported prosecutors sought to keep him in custody pending trial and that records in the case were under seal. A report by The Globe and Mail, published October 15, is also referenced in the source material, but its relevant details are incomplete and are not expanded here.
“FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website.”
— KrebsOnSecurity, citing two sources close to the investigation
As an affiliate, we earn on qualifying purchases.
Evidence and Charges Still Pending
The unnamed consulting executive’s identity, precise role and the evidence behind the FBI’s suspicion have not been made public in the supplied reporting. No charge against that person or the consulting firm is reported, and investigators’ conclusions remain allegations unless supported in public court proceedings. It is also unclear whether other executives or employees were involved, or whether the company itself is under investigation.
The reported messages and their interpretation have not been presented in full. Dubrovsky has been charged, but the source material does not provide his response to the allegations or the outcome of any detention hearing. The FBI has not publicly set out how much of the ShinyHunters investigation it has confirmed. The reported total of more than $70 million is attributed to the bureau, but the source does not state the exact calculation method or comparison period beyond “so far this year.”
secure communication apps for professionals
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Possible Next Steps in the Probe
The next public developments are likely to come through court filings, detention proceedings or new law-enforcement statements in Dubrovsky’s case and any related investigations. If charges are brought against the unnamed executive or others, those filings could clarify the alleged roles, communications and evidence. Until then, the identities and legal status of the suspected consulting-firm participants remain undisclosed in the reporting.
Organizations affected by ShinyHunters breaches may also continue to assess whether their information appeared on ShinyWire or was published elsewhere. The site’s reported closure on October 16 does not, by itself, establish that stolen data has been deleted or that the group has stopped operating. The source material gives no confirmed schedule for further FBI announcements or court action.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are federal investigators reported to suspect?
KrebsOnSecurity reports that the FBI suspects at least one executive at an unnamed U.S. consulting firm helped operate ShinyWire, a website used to list ShinyHunters victims and press them to negotiate. The executive has not been publicly named or charged in the supplied reporting.
What did ShinyWire do?
The site reportedly listed nearly 100 organizations, encouraged them to discuss payment with ShinyHunters, displayed samples of stolen data and threatened publication. It was active from approximately May 3 to October 16, 2026, according to KrebsOnSecurity.
Has the suspected consulting executive been charged?
No charge against the unnamed executive is reported. The allegation comes from sources cited by KrebsOnSecurity and has not been established in court.
Who is Edward Dubrovsky, and what is his status?
Dubrovsky is a Canadian cybersecurity executive arrested by the FBI on October 9, according to KrebsOnSecurity. Court records cited in the report say he was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. The supplied material does not provide the outcome of his case.
Was the FBI’s recruitment website data published?
The source says ShinyHunters threatened on X to publish data allegedly stolen from fbijobs.gov, including sensitive personal and employment information. The supplied reporting does not confirm whether all of that data was ultimately published.
Source: hn
