U.S. federal investigators have identified executives at two ransomware negotiation firms who maintained close contact with the ShinyHunters hacking group, according to sources familiar with the case. The group, which has extorted over $70 million from victims this year, recently stole sensitive data from the FBI and threatened to publish personnel records. Dutch authorities arrested ShinyHunters suspect Pepijn van der Stap on September 15, 2026, while he was logged into a Signal account. His messages revealed communications with Canadian cybersecurity executive Edward Dubrovsky and a U.S.-based consulting firm executive. Federal investigators say Dubrovsky knew ShinyHunters had breached FBI systems but did not notify the bureau before the group threatened to release stolen data. The arrest of van der Stap led to the detention of Rey, a teenage hacker from Jordan who had taken control of the group after earlier members were apprehended. Dubrovsky was arrested by the FBI on October 9, 2026, and charged with extortion-related offenses. He had recently published guidance recommending engagement with hackers. A Canadian lawsuit filed by Dubrovsky against former business partner Daniel Tobok alleged professional misconduct, while Tobok countersued accusing Dubrovsky of accessing confidential information. Tobok was previously known by the alias Ghostbyte, a name linked to ransomware negotiations involving Dharma affiliates. Constella Intelligence found Tobok’s email address associated with the Ghostbyte alias. Cypfer, Tobok’s former company, stated it had no prior knowledge of Dubrovsky’s arrest and is not under investigation. The U.S. Department of Justice has charged several ransomware negotiators, including MonsterCloud CEO Zohar Pinhasi, with wire fraud for allegedly paying hackers while charging clients. ShinyHunters has targeted organizations including PowerSchool, which paid a $2.85 million ransom in December 2024. The group’s activities have drawn warnings from cybersecurity firms about the risks of paying extortion demands, as stolen data is often retained or resold. The FBI has emphasized that paying ransomware groups does not guarantee data deletion and may encourage further attacks. The investigation remains ongoing, with authorities focusing on individuals who facilitated ShinyHunters’ operations through negotiation services.