Federal investigators are examining whether a senior figure at a large American consulting firm quietly helped the extortion gang ShinyHunters run a website used to pressure breached companies into paying up. The site, tracked as shinywire[.]com, is reported to have operated from early May through mid-October 2026, listing nearly 100 organizations the group claimed to have hacked.

The allegation, first reported by KrebsOnSecurity and citing sources close to the ongoing investigation, would mark an unusual twist in ransomware cases: a trusted adviser hired to help victims respond to an attack allegedly working both sides of the negotiation table. No charges have been filed against the suspected website operator, and the person has not been publicly named.

A Parallel Arrest Adds Pressure to the Case

The scrutiny comes alongside the arrest of Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive detained in Pennsylvania on October 8. Dubrovsky faces separate federal allegations tied to a conspiracy to threaten the release of stolen data for payment and to interfere with commerce through threats. Court records confirm his arrest and transfer to the Eastern District of Texas, but the complaint against him remains sealed, limiting what the public can verify about the specific conduct prosecutors allege.

Investigators reportedly do not claim that Dubrovsky personally ran the extortion website. Instead, sources say the leads connecting him, and an executive at the unnamed consulting firm, to ShinyHunters came after Dutch police arrested a separate suspect, Pepijn van der Stap, in September. While van der Stap remained logged into Signal, officers are said to have reviewed his message history, allegedly surfacing frequent contact between him and both executives.

How the Extortion Site Pressured Victims

According to the reporting, shinywire[.]com worked as a public-shaming mechanism layered on top of direct extortion demands. Each listed organization had its own page showing samples of allegedly stolen files, along with instructions to contact the group and negotiate payment. Companies that failed to respond within roughly seven days reportedly risked having their stolen data published on a separate Tor-based leak site, a deadline-driven tactic designed to push victims toward paying quickly rather than consulting law enforcement.

Some of the exchanges reviewed by investigators allegedly suggest that one or both executives knew details about new ShinyHunters victims before those organizations were even aware they had been breached. Sources also told KrebsOnSecurity that Dubrovsky may have learned that sensitive data stolen from the FBI itself had been compromised before the group threatened to leak it. None of these claims have been tested in open court, and both men’s conduct remains under investigation rather than established fact.

• ShinyHunters typically gains access through phishing and credential theft rather than deploying file-encrypting malware.
• The group has been linked by the FBI to more than $70 million in extortion payments collected during 2026 alone.
• Victims span retail, technology, and government-adjacent organizations, including the FBI’s own recruitment site, which was breached in September.

Why Ransomware Negotiators Are Under New Scrutiny

The case has reignited longstanding concerns about the incentive structures built into the ransomware negotiation industry. Firms that help victims communicate with attackers sometimes charge fees that scale with the size of the final payment, an arrangement that critics say can quietly reward advisers for pushing victims toward paying more rather than less. CyberAcuView chief executive Mark Camillo told KrebsOnSecurity that the industry needs far greater transparency around how negotiators are compensated, including fees tied to cryptocurrency transfers.

The episode echoes an earlier case involving the PowerSchool breach, in which a school software vendor paid roughly $2.85 million to stop data from being released, only for affected school districts to later face fresh extortion attempts built on the same stolen records. That outcome underscored a recurring lesson in ransomware response: a payment rarely guarantees that stolen information disappears, and the same dataset can be monetized by criminals more than once.

What Organizations Should Take Away

Security teams evaluating third-party incident response support should treat this case as a prompt to ask harder questions about who is advising them during a breach, and how those advisers are paid. The FBI’s existing guidance on ShinyHunters, issued in May, still applies broadly: victims contacted directly by extortionists should avoid engaging or paying, preserve all communications, and report the incident through the IC3 portal or a local field office rather than relying solely on a private intermediary.

For now, the allegations against the unnamed executive remain just that: a reported investigative theory rather than a criminal charge. Dubrovsky’s case will proceed separately in federal court. Both threads of the investigation are likely to shape how organizations vet ransomware response vendors going forward, particularly when those vendors sit close to the criminal ecosystems they are hired to help clients escape.