Federal agents arrested Edward Dubrovsky, a Toronto-based cybersecurity executive, as a suspected co-conspirator in the recent FBIjobs.gov data breach.
FBI Director Kash Patel announced on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters group. The New York Times reported the suspect is a Canadian citizen arrested in Pennsylvania and considered a primary co-conspirator in the intrusion.
Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor
Court documents identify the arrested person as Edward Dubrovsky, who invests in cyber ventures and operates out of Toronto. Dubrovsky, 54, faces charges including conspiracy to impair information confidentiality for extortion and interfering with commerce through threats.
Dubrovsky previously served as managing director at Cypfer, an incident response firm, and now works with CyberSteward, a cyber-consulting company. He authored Cyber Extortion Strategic Response, a book described as a guide for leaders on handling coercion, negotiation, and settlements.
Patel's post did not name the suspect or say whether the suspect took part in the breach. CBS News cited a law enforcement source stating the individual is thought to have played a direct role in the hack.
Reuters noted this is the third arrest made public since the breach news emerged in late September. The FBI stated in a 3 October report that it had already collaborated with partners to detain multiple subjects.
Timeline of Arrests
Three key arrests have occurred in rapid succession following the disclosure of the breach. Dutch police arrested Pepijn van der Stap, a 24-year-old Amsterdam man previously known online as Umbreon, on 15 September as part of an investigation into the hacking group. Custody of the suspect in the Netherlands occurred one week prior to the 22 September announcement by ShinyHunters regarding the FBI breach.
Saif Al-din Khader, also known as Rey, was detained in Jordan on 29 September. The 17-year-old is said to be cooperating with the FBI's investigation. Multiple FBI sources told Reuters that Saif al-Din Khader was arrested in Jordan on 28 September, having been earlier pinpointed by media and researchers as a central figure in the group.
Conflicting Reports on Khader Arrest Date
Infosecurity Magazine Report
Arrest Date
- Saif Al-din Khader taken into custody on 29 September
Reuters Report
Arrest Date
- Multiple FBI sources state arrest occurred on 28 September
Breach Mechanics and Data Scope
ShinyHunters exploited a vulnerability in Oracle PeopleSoft to compromise the FBI's jobs site, then pivoted to its AWS GovCloud servers to extract 2-3TB of data. Brett Leatherman, assistant director of the FBI's Cyber Division, told Reuters on 5 October that an external platform managed by a contractor caused the breach because a specific security patch was not applied.
The FBI has removed the contractor. It has been reported that an Accenture contractor lost their position with the bureau because they did not fix the flaw ShinyHunters later used. Two sources told Reuters the unnamed platform is Oracle's human resources software, PeopleSoft, and the organization is Accenture.
| Component | Detail |
|---|---|
| Vulnerable Platform | Oracle PeopleSoft |
| Responsible Contractor | Accenture (reported) |
| Data Volume | 2-3TB |
| Data Types | Medical records, psychiatric records, employee details |
The threat actors said they stole between 2TB and 3TB of data, which included records on current and former FBI employees, job applicants, medical and psychiatric files, and internal service logs. A Reuters analysis found that a sample shared by ShinyHunters held vast amounts of private data on staff, specifics regarding sensitive positions, and health-related records.
The breach could rank among the most severe government compromises in recent history if hackers indeed obtained personal identifiers such as names, addresses, phone numbers, birth dates, Social Security numbers, and emergency contacts for thousands of FBI employees, including those in counter-intelligence work. The breach also exposed thousands of records about local police officers who work with the FBI on task forces.
The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.
The FBI alleges the group has compromised over 140 organizations and collected at least $70 million in extortion payments since last year. The group's main representative stopped responding on Telegram last Tuesday, and that Telegram account now appears to have been deleted.
A new leak site for ShinyHunters appeared later, indicating that some operators are still active. Messages sent to several news outlets indicated ShinyHunters would not release the stolen information and wished to avoid escalating the conflict with the FBI, which they attributed to a disputed advisory about their actions.
We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI,
Patel said the FBI will keep working with partners to dismantle the remaining elements of the ShinyHunters group and their associates, regardless of their location.
