U.S. federal investigators pursuing the prolific "ShinyHunters" hacking group—which recently shocked the cybersecurity community by exfiltrating highly sensitive data from the FBI—have uncovered evidence of an alarming, incestuous relationship between the cybercriminals and the very firms hired to stop them. Sources close to the investigation have revealed that executives at two prominent ransomware negotiation firms maintained unusually close, and potentially criminal, ties with the extortionists. One of these U.S.-based executives is alleged to have actively assisted the ShinyHunters in operating a web portal designed specifically to pressure victims into paying ransoms.
The ShinyHunters collective has become a dominant force in the cyber-extortion landscape, claiming credit for dozens of major data breaches since 2019. Originally based in France, the group’s leadership structure shifted as authorities successfully arrested or imprisoned its founding members. Control eventually migrated to an individual known as "Rey," identified last year as a teenage hacker residing in Amman, Jordan. According to FBI assessments, the group’s operations have been staggering in scale, with the organization extorting more than $70 million from victims within the current calendar year alone.
The group’s brazen nature reached a fever pitch in late September 2026, when they successfully infiltrated the FBI recruitment portal, fbijobs.gov. The hackers taunted the federal agency, threatening to leak a treasure trove of sensitive files. The stolen data reportedly contained medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the unit and specialization of various employees.
The breach of a federal jobs portal triggered a rapid response from the FBI, which moved with unprecedented speed to detain and interrogate anyone suspected of having ties to Rey or his associates. This pressure bore fruit on October 3, when Reuters reported that Jordanian authorities had detained Rey, who is now reportedly cooperating with the FBI investigation.
The Downfall of a Key Lieutenant
Rey’s rise to power within the group was precipitated by the sudden removal of one of its most senior operatives. On the evening of September 15, 2026, Dutch authorities conducted a dramatic raid to arrest Pepijn van der Stap, a convicted hacker and suspected senior member of ShinyHunters. Dutch police utilized flash-bang grenades to disorient and apprehend Van der Stap while he was actively logged into several online accounts.
According to sources close to the investigation, the timing of the arrest was critical. Authorities seized Van der Stap while he was using his Signal instant messaging account, which contained a wealth of recent communications with key contacts, including ransomware negotiators based in Canada and the United States. These messages proved to be a goldmine for federal agents, providing a roadmap for the investigation and even uncovering a disturbing murder-for-hire plot. Reports from the Dutch news outlet RTL indicated that Van der Stap had allegedly issued orders for two murders to be carried out abroad, though there is no evidence that these orders were ever executed.
The digital trail left by Van der Stap quickly led to the doorstep of Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive. On October 9, the FBI arrested Dubrovsky in connection with the ongoing probe. Dubrovsky, who had recently authored a book on cyber extortion that advocated for always engaging with hackers, now faces federal charges for threatening to disclose stolen data and interfering with interstate commerce through extortion. According to court records, federal prosecutors have requested that Dubrovsky remain in custody pending trial, and much of the documentation surrounding his case remains under seal.
The evidence suggests a pattern of collusion. Sources indicate that Van der Stap’s Signal messages showed frequent, substantive conversations between him, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. These negotiators were often privy to the details of new ShinyHunters breaches before the victims themselves had even discovered they were under attack. Perhaps most damningly, investigators discovered that Dubrovsky was aware of the ShinyHunters’ theft of sensitive FBI data and failed to notify the bureau, even as the hackers publicly threatened to expose the agency’s internal records on social media.
"Shinywire" and the Business of Extortion
Investigators believe these executive contacts were not merely passive observers but active participants in the group’s business model. Specifically, sources allege that an executive at a prestigious U.S.-based consulting firm—a company with over 1,000 associates—played an active role in operating "shinywire[.]com," a now-defunct portal dedicated to victim extortion.
The Shinywire website, which was active from early May 2026 until mid-October, served as a centralized platform for the group’s demands. It listed nearly 100 organizations that had fallen victim to ShinyHunters. Each listing functioned as a pressure cooker, urging companies to negotiate payment and offering "samples" of stolen data to demonstrate the hackers’ leverage. The site carried an implicit ultimatum: if a victim failed to engage within seven days, their stolen data would be published on the ShinyHunters’ Tor-hosted shaming blog. One such listing targeted Intuitive Surgical, an American medical technology company that suffered a significant breach earlier in 2026 after a targeted phishing attack compromised employee credentials.
The connections between these executives and the criminal underworld appear to have deep roots. Long before the recent arrests, industry insiders noted that some individuals within the cybersecurity consulting space were known by aliases in the ransomware ecosystem. Reports have surfaced that Daniel Tobok, the former CEO of the Toronto-based cybersecurity firm Cypfer, was known to ransomware purveyors as "Ghostbyte."
In 2018, when a Canadian company was hit by the Dharma ransomware, the attackers themselves directed the victim to reach out to an IT professional they trusted. In a chilling email reply, the ransomware representative explicitly suggested that the victim contact an individual at a Canadian IT firm using the email address "[email protected]" to secure guarantees for the ransom payment. While it remains unclear if Tobok personally utilized that specific address, digital forensic services have linked email addresses frequently used by Tobok to online accounts registered under the "Ghostbyte" username. Furthermore, the cryptocurrency wallet associated with the Dharma representative involved in that exchange processed transactions totaling roughly $3.5 million.
Conflicts of Interest in the Insurance Ecosystem
The legal landscape surrounding these payments is complex. While paying a ransom to recover encrypted files or prevent data publication is not inherently illegal in the United States—unless the group is under federal sanctions—the practice creates a massive moral and economic hazard.
Ransomware victims are often funneled toward specific incident response firms by their insurance providers. However, a divide has emerged in the industry: some firms refuse to facilitate payments, while others appear to specialize in it. This has led to a climate where firms that prioritize security over payouts are frequently replaced by "payment-friendly" consultants when a client decides they want to pay.
The financial incentives are particularly concerning. Many of these negotiators charge a percentage of the final ransom amount, creating a perverse incentive to inflate the settlement rather than negotiate it down. Mark Camillo, CEO of the industry group CyberAcuView, noted that this dynamic is an inherent conflict of interest. "It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said. "There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction."
The consequences of these misaligned incentives were evident in the 2024 breach of PowerSchool, which saw the personal information of over 70 million individuals compromised. Despite a $2.85 million ransom payment facilitated by CyberSteward, the stolen data continued to circulate, leading to secondary extortion attempts against individual school districts. Leading incident response firms, such as Coveware and Unit 221B, have consistently warned that paying these groups is futile, as there is no technical mechanism to ensure hackers actually delete stolen data.
Internal communications from the ShinyHunters themselves highlight the extent to which these ethical firms have hindered the criminals’ bottom line. In private Telegram chats, the group’s operators expressed frustration that companies were refusing to pay due to the "misinformation" provided by firms like Coveware. "Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," the group wrote in May 2026. The hackers even discussed "eliminating the problem," confirming the effectiveness of the advice being given to victims.
As federal authorities continue to dismantle the infrastructure surrounding the ShinyHunters, the focus is shifting toward the professional intermediaries who facilitated these crimes. With recent prosecutions of executives like Zohar Pinhasi of MonsterCloud and Angelo Martino—who was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group—the message from the Department of Justice is clear: the era of "negotiators" acting as double agents for cybercriminals is coming to a definitive end.
