What Happened
Krebs on Security reports federal investigators found executives at two ransomware negotiation firms with unusually close ties to ShinyHunters. One U.S. executive is suspected of helping run Shinywire, the group’s extortion site. The site listed nearly 100 victims between early May and October 16. Messages seized from arrested member Pepijn van der Stap reportedly show negotiators knew of new victims before the victims did. Canadian executive Edward Dubrovsky faces extortion charges. No U.S. executive has been charged.
Why This Matters for Canadian Organizations
The story runs through Canada. Dubrovsky is a Canadian executive, the investigation touches Toronto-founded Cypfer, and van der Stap reportedly contacted negotiators in both Canada and the U.S. Cypfer states it does not make or facilitate ransomware payments and has had no contact with law enforcement. ShinyHunters also hit Canadian students and teachers through the 2024 PowerSchool theft.
Your incident response retainer holds your most sensitive data on your worst day. A negotiator who profits from the payment has a conflict of interest. Boards and insurers in Canada should treat vendor independence as a control, not a courtesy.
What to Do
Ask every incident response and negotiation vendor how it earns its fee. Percentage-of-ransom pricing deserves scrutiny. Require written confirmation of sanctions screening and payment handling. Limit what negotiators receive to what the work needs. Follow the FBI guidance against paying ShinyHunters, and report extortion to the RCMP and the Canadian Centre for Cyber Security. Read more in our Trends coverage and our News archive.
