Federal investigators suspect that an executive at an unnamed U.S. consulting firm helped operate the ShinyHunters extortion site known as Shinywire, according to KrebsOnSecurity. The reported suspect has not been identified or charged, a distinction that matters because the investigation has separately produced criminal charges against Canadian cybersecurity executive Edward Dubrovsky.
KrebsOnSecurity, citing two people close to the investigation, reported that the FBI believes at least one executive at a U.S.-based firm played an active part in running shinywire[.]com. The publication withheld the company and executive's names because neither had been charged. It described the firm as having more than 1,000 associates.
The allegation relies on unnamed investigative sources, and no public court filing described in the reporting names an alleged Shinywire operator. It is an investigative theory, not a finding of guilt.
What was the Shinywire extortion site?
Shinywire was a public-facing pressure tool for alleged ShinyHunters victims. KrebsOnSecurity reported that it operated from about May 3 through October 16, 2026, and listed nearly 100 organizations said to have been hacked by the group.
Each listing urged a victim to contact the group to discuss payment terms, displayed samples of files said to have been stolen, and warned that the material would be published if demands were ignored. That is the basic extortion mechanism: show enough data to make a breach credible, then use the threatened release as leverage for payment.
ShinyHunters has generally been reported to obtain corporate data through phishing and stolen credentials used against software-as-a-service accounts, then threaten publication unless a victim pays. The FBI has said the group collected more than $70 million from victims in 2026, according to KrebsOnSecurity.
How did investigators reach ransomware negotiators?
The reported trail runs through Pepijn van der Stap, a convicted hacker and ShinyHunters suspect arrested by Dutch authorities on September 15. A source close to the inquiry told KrebsOnSecurity that van der Stap was using Signal when he was arrested, giving authorities access to recent exchanges with frequent contacts, including ransomware negotiators in Canada and the United States.
Those messages allegedly showed regular contact between van der Stap, Dubrovsky and at least one executive at the U.S. consulting firm. Sources told KrebsOnSecurity that the executives sometimes knew about new ShinyHunters victims before the victims learned of the breaches.
Dubrovsky is not identified in the supplied reporting as the unnamed executive suspected of operating Shinywire. Court records summarized by KrebsOnSecurity say an Edward Dobrovsky, with a differently spelled surname, was arrested in Pennsylvania on October 8 on charges including conspiracy to threaten the confidentiality of information to extort money and interference with commerce by threats. Several records, including the core complaint, were sealed.
KrebsOnSecurity reported on October 9 that Edward Dubrovsky had been arrested in connection with the ShinyHunters investigation and faced charges of threatening to disclose stolen or hacked information and extortion-related interference with interstate commerce. The outlet said he could not immediately be reached for comment and that available records indicated he had not yet been assigned counsel.
The investigation accelerated after ShinyHunters allegedly breached the FBI's recruitment site in late September and threatened to release personnel information, according to KrebsOnSecurity. Reuters reported on October 3 that Jordanian authorities had detained the group's alleged administrator, known as Rey, who was cooperating with the FBI.
This story draws on original reporting from Krebs on Security.
