Feds suspect ransomware negotiation executives helped ShinyHunters run Shinywire extortion site after FBI jobs portal breach
U.S. federal investigators pursuing ShinyHunters, which recently stole sensitive personnel data from the FBI recruitment site fbijobs.gov, reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group. One U.S. consulting firm executive is suspected of helping operate the now-defunct extortion site shinywire[.]com, active from about May 3 to October 16, 2026, with entries for nearly 100 victim organizations. The FBI arrested Canadian executive Edward Dubrovsky on extortion-related charges, and chats recovered from the Signal account of arrested ShinyHunters suspect Pepijn van der Stap allegedly show Dubrovsky knew of the FBI data theft and did not tell the bureau. The FBI says ShinyHunters has extorted more than $70 million this year. Leader Rey, a teenager from Amman, Jordan, was reportedly detained and is cooperating with the FBI. Claims about the unnamed U.S. firm and executives are unproven because no charges have been filed, and Cypfer denies facilitating ransom payments.
Technical Details
- ShinyHunters stole FBI personnel files (medical and psychological records, SSNs, home addresses, unit and specialization data) from fbijobs.gov in late September 2026 and threatened to publish them on Twitter/X.
- The Shinywire site urged victims to negotiate and showed samples of stolen files. Victims who did not engage within seven days had their data published on a Tor-based shaming blog.
- Intuitive Surgical was breached in March 2026 through a targeted phishing email that compromised an employee's credentials.
- Van der Stap was arrested on September 15, 2026 in the Netherlands while logged into Signal, which exposed his chats with negotiators in Canada and the U.S. Those executives allegedly often knew of new victims before the victims did. His messages also reportedly exposed a murder-for-hire plot, with no indication it was carried out.
- The article links Daniel Tobok, former Cypfer CEO, to the nickname "Ghostbyte". A 2018 Dharma ransomware reply to a victim pointed to [email protected], and Constella Intelligence ties [email protected] to "ghostbyte" accounts. Tobok has not commented, and the article says it is unclear whether he used that address.
- ShinyHunters complained privately on Telegram that Coveware's advice against paying was hurting its payment rates, and members have harassed Coveware and Unit 221B staff.
- PowerSchool paid a $2.85 million ransom in the December 2024 breach, but school districts later received separate demands using the same stolen data.
- Related DOJ cases include MonsterCloud CEO Zohar Pinhasi (charged October 7 with wire fraud and conspiracy for secretly paying hackers $8M while billing customers $19M) and negotiator Angelo Martino (sentenced to 70 months for leaking client negotiation strategy to BlackCat/ALPHV).
Remediation
- Do not rely on payment to guarantee data deletion. The FBI (May 15, 2026 alert), Coveware and Unit 221B advise against paying ShinyHunters, since stolen data is often retained, resold or reused for extortion.
- Ask negotiation and incident response vendors to disclose fee structures, since percentage-of-ransom fees create a conflict of interest, and review their vetting and independence.
- Strengthen phishing-resistant authentication and employee phishing defenses, since targeted phishing was the initial vector in the Intuitive Surgical breach.
- Report breaches promptly to law enforcement.
Linha do tempo
-
Feds suspect ransomware negotiation executives helped ShinyHunters run Shinywire extortion site after FBI jobs portal breach
ler a análise desta fonte ocultar
U.S. federal investigators pursuing ShinyHunters, which recently stole sensitive personnel data from the FBI recruitment site fbijobs.gov, reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group. One U.S. consulting firm executive is suspected of helping operate the now-defunct extortion site shinywire[.]com, active from about May 3 to October 16, 2026, with entries for nearly 100 victim organizations. The FBI arrested Canadian executive Edward Dubrovsky on extortion-related charges, and chats recovered from the Signal account of arrested ShinyHunters suspect Pepijn van der Stap allegedly show Dubrovsky knew of the FBI data theft and did not tell the bureau. The FBI says ShinyHunters has extorted more than $70 million this year. Leader Rey, a teenager from Amman, Jordan, was reportedly detained and is cooperating with the FBI. Claims about the unnamed U.S. firm and executives are unproven because no charges have been filed, and Cypfer denies facilitating ransom payments.
Technical Details
- ShinyHunters stole FBI personnel files (medical and psychological records, SSNs, home addresses, unit and specialization data) from fbijobs.gov in late September 2026 and threatened to publish them on Twitter/X.
- The Shinywire site urged victims to negotiate and showed samples of stolen files. Victims who did not engage within seven days had their data published on a Tor-based shaming blog.
- Intuitive Surgical was breached in March 2026 through a targeted phishing email that compromised an employee's credentials.
- Van der Stap was arrested on September 15, 2026 in the Netherlands while logged into Signal, which exposed his chats with negotiators in Canada and the U.S. Those executives allegedly often knew of new victims before the victims did. His messages also reportedly exposed a murder-for-hire plot, with no indication it was carried out.
- The article links Daniel Tobok, former Cypfer CEO, to the nickname "Ghostbyte". A 2018 Dharma ransomware reply to a victim pointed to [email protected], and Constella Intelligence ties [email protected] to "ghostbyte" accounts. Tobok has not commented, and the article says it is unclear whether he used that address.
- ShinyHunters complained privately on Telegram that Coveware's advice against paying was hurting its payment rates, and members have harassed Coveware and Unit 221B staff.
- PowerSchool paid a $2.85 million ransom in the December 2024 breach, but school districts later received separate demands using the same stolen data.
- Related DOJ cases include MonsterCloud CEO Zohar Pinhasi (charged October 7 with wire fraud and conspiracy for secretly paying hackers $8M while billing customers $19M) and negotiator Angelo Martino (sentenced to 70 months for leaking client negotiation strategy to BlackCat/ALPHV).
Remediation
- Do not rely on payment to guarantee data deletion. The FBI (May 15, 2026 alert), Coveware and Unit 221B advise against paying ShinyHunters, since stolen data is often retained, resold or reused for extortion.
- Ask negotiation and incident response vendors to disclose fee structures, since percentage-of-ransom fees create a conflict of interest, and review their vetting and independence.
- Strengthen phishing-resistant authentication and employee phishing defenses, since targeted phishing was the initial vector in the Intuitive Surgical breach.
- Report breaches promptly to law enforcement.