Co-founder of ransom negotiator CYPFER arrested in the US on extortion charges

Edward Dubrovsky, a 54-year-old Canadian citizen and co-founder of CYPFER, was arrested on October 8 in Pennsylvania by US federal authorities. CYPFER is a company that specializes in negotiating with cybercriminals and paying ransoms. According to court documents cited by BleepingComputer and CyberScoop, he is charged with conspiracy to threaten the confidentiality of data in order to extort money, an offense under the federal computer fraud law. He is also charged with extortion under the Hobbs Act. The complaint is sealed, so it is not known exactly what he is accused of. He is presumed innocent.

A link to ShinyHunters, not officially confirmed

FBI Director Kash Patel announced on social media the arrest of another "alleged accomplice" of the ShinyHunters group, without naming them. The New York Times and Politico reported the arrest of a Canadian in Pennsylvania. KrebsOnSecurity, relying on several sources, identified him as Dubrovsky and ties the arrest to the ShinyHunters investigation. The FBI has not publicly confirmed this link. Asked by CyberScoop, neither Dubrovsky nor CYPFER responded.

Also according to BleepingComputer, Dubrovsky first appeared before a federal court in Pennsylvania. He was then transferred to the Eastern District of Texas, where the charges were brought, and remains in custody. The court documents spell his name "Dobrovsky." According to Politico, CyberSteward, another company he is associated with, is a trade name of CYPFER.

ShinyHunters is an extortion group that steals data from web applications and SaaS (online software) platforms, then demands a ransom. According to the FBI, cited by BleepingComputer, the group and its accomplices allegedly hit more than 140 organizations and collected more than $70 million in one year. The FBI itself was targeted: according to CyberScoop, the attack on its systems exposed personal data of thousands of its employees. Other alleged members have recently been arrested, including in the Netherlands in September and in Jordan.

What this changes for victims

The case has not gone to trial, but it sheds light on a discreet player in crisis management: the negotiator, often recommended by the insurer or the incident response provider. A few reflexes to keep in mind:

• In France, authorities advise against paying: nothing guarantees that data will be returned or deleted. File a complaint and report the incident (and to the CNIL, the French data protection authority, in case of a personal data breach).
• Keep control of the negotiation: demand to see all exchanges with the attackers and the proof of each payment.
• Vet your providers before a crisis: who intervenes, with what mandate, and on whose recommendation. Build this into your incident response plan and your insurance contract.