The person negotiating with the criminal on your behalf may be on the criminal’s side. That is the suspicion raised by US investigators in the ShinyHunters case, an extortion group that, according to the FBI, has pulled in more than $70 million in 2026 alone.
What is confirmed
Krebs on Security lays out a string of arrests. On September 15, Dutch police arrested Pepijn van der Stap, a convicted hacker suspected of ties to the group. On October 9, the FBI arrested Edward Dubrovsky, 54, a Canadian security executive, charged with threatening to disclose stolen data and with extortion. Prosecutors asked that he be held until trial. Reuters reported on October 3 that “Rey”, identified as the group’s leader, was detained in Jordan and is cooperating with the FBI.
In late September, the group hacked the FBI’s recruitment site and threatened to publish employee files. On May 15, the FBI had already warned victims not to pay ShinyHunters.
What is still allegation
The strongest part of the report rests on unnamed sources and has not been tested in court. According to them, van der Stap’s Signal messages would show frequent contact with Dubrovsky and with an executive at a large US consulting firm, and those executives would have known about new victims before the victims did. Dubrovsky is also said to have known about the theft of FBI data without telling the agency. An extortion site tied to the group, active from May to October 16, listed nearly 100 victims, and sources say an executive at a US consulting firm played an active role in it. No one has been charged over that, and the firm is not named. Cypfer said it does not facilitate ransom payments and had no prior knowledge of the arrest.
Why it matters
The report notes that paying a ransom is not illegal in the US unless the recipient is sanctioned, and that charging a percentage of what the victim pays creates a conflict of interest. The practical conclusion matches the FBI’s: paying guarantees nothing.
How to protect yourself
- Do not pay a ransom without official guidance. Talk to the police and an independent specialist.
- Keep offline backups so you do not depend on the criminal.
- Train staff against pressure by phone and message. According to the report, the group allegedly harassed employees at firms that advise against paying.
- Turn on phishing-resistant two-step verification on company accounts.
- Record everything the extortionist says, for the investigation.
