TL;DR
KrebsOnSecurity reports that FBI investigators suspect at least one executive at an unnamed U.S. consulting firm helped run ShinyHunters’ now-defunct extortion website. The report is based on sources close to the investigation; the executive has not been named or charged, and the alleged role has not been established in court.
Federal investigators suspect at least one executive at a U.S.-based consulting firm helped operate ShinyHunters’ extortion website, according to a report by KrebsOnSecurity, adding a possible insider role to an investigation into the hacking group. The suspected executive has not been named or charged, and the allegation has not been tested in court.
KrebsOnSecurity said two sources close to the ShinyHunters investigation told the publication that FBI investigators believe a consulting-firm executive had an active role in running Shinywire, a website used to pressure organizations whose data the group had stolen. The outlet did not identify the company or executive, saying the suspected individuals had not been charged. It described the firm as a prestigious U.S. company with more than 1,000 associates.
The site was active from approximately May 3 through October 16, 2026, according to the report, and listed nearly 100 organizations. Its pages urged victims to contact ShinyHunters to discuss payment, displayed samples of allegedly stolen files and threatened publication if victims did not respond. KrebsOnSecurity said organizations that failed to negotiate within seven days faced publication of their data on the group’s Tor-based victim-shaming blog.
The report connects the suspicion to communications obtained after Dutch authorities arrested Pepijn van der Stap, a convicted hacker and ShinyHunters suspect, on September 15. A source told KrebsOnSecurity that investigators reviewed recent Signal messages on his account and found frequent exchanges with Canadian cybersecurity executive Edward Dubrovsky and at least one executive at the U.S. consulting firm. The source alleged that the executives sometimes knew about new victims before those organizations did. These claims have not been independently established in court.
Why the Suspected Insider Role Matters
The allegation, if substantiated, would suggest that people involved in professional cyber-extortion response may have had ties to the criminal operation they were expected to help victims manage. That could undermine trust in negotiations, where organizations may share sensitive information with advisers while trying to limit damage and avoid further disclosure.
The report also raises questions about how ShinyHunters coordinated its public pressure campaign. Shinywire did more than list alleged victims: it set out payment demands, posted samples and gave organizations a deadline before threatened publication. An executive’s alleged involvement in operating that site would represent a different kind of connection from simply communicating with hackers as a negotiator. The precise nature of the suspected role remains unconfirmed.
The case has particular significance because the FBI itself was reportedly among the victims. KrebsOnSecurity said ShinyHunters stole sensitive information from the FBI recruitment website, including personnel records and personal identifiers. A source told the outlet that Dubrovsky knew of the breach before the bureau was publicly threatened, but the report does not establish that the unnamed consulting executive knew about that specific incident or what either person did with any information.
cybersecurity threat detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Arrests and the Shinywire Timeline
ShinyHunters-linked hackers have claimed responsibility for dozens of major data breaches since 2019, according to the source report. The group’s membership and leadership have changed over time. KrebsOnSecurity said the original members were primarily cybercriminals in France and that control later passed to an individual known as “Rey,” identified by the outlet as a teenage hacker from Amman, Jordan. Reuters reported on October 3 that Jordanian authorities had detained Rey and that he was cooperating with the FBI. The source material does not provide additional detail about the terms or scope of that cooperation.
Van der Stap’s arrest in the Netherlands preceded the U.S. investigation’s reported focus on his communications. On October 9, KrebsOnSecurity reported the FBI had arrested Dubrovsky, a 54-year-old Canadian cybersecurity executive. Court records, as described by the outlet, show charges alleging he threatened to disclose stolen or hacked data and interfered with interstate commerce through extortion. Politico reported prosecutors sought to keep him in custody before trial and that records in the case were sealed.
The source material also describes a separate, serious allegation arising from Van der Stap’s messages: multiple sources told KrebsOnSecurity that the communications helped investigators examine a suspected murder-for-hire plot. RTL reported that the alleged attacks were to take place abroad and that Van der Stap may have ordered them; the source says there is no indication the orders were carried out. That allegation remains distinct from the claims about Shinywire and should not be treated as proof of the consulting executive’s involvement.
“Investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website.”
— Sources close to the investigation, speaking to KrebsOnSecurity
As an affiliate, we earn on qualifying purchases.
What Investigators Have Not Disclosed
The U.S. consulting firm and the executive or executives under suspicion have not been identified. The report does not cite a public FBI statement confirming the alleged Shinywire role, and it says the suspected executive has not been charged. The evidence investigators have gathered, the individual’s precise conduct and whether prosecutors will bring charges remain unknown.
It is also unclear what the messages between Van der Stap, Dubrovsky and the unnamed executive contained beyond the descriptions provided by sources to KrebsOnSecurity. The report does not establish whether the executive had access to stolen files, helped make ransom demands, received money or knew about the FBI breach. Dubrovsky faces charges, but the allegations against him are not findings of guilt. The FBI breach’s full scope and whether all threatened data was released are not detailed in the supplied reporting.
cybersecurity incident response kit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Investigative and Court Milestones Ahead
The next public developments are likely to come through court filings or official statements as the FBI investigation proceeds. Dubrovsky’s case will move through the U.S. court process, while prosecutors’ request to keep him in custody and the sealing of related records may limit what becomes public in the near term. No charge or court date for the unnamed consulting executive is described in the report.
Readers should distinguish any future law-enforcement allegation from evidence tested at trial. The investigation may clarify whether Shinywire was operated with help from someone outside the hacking group, how the alleged communications related to ransom negotiations and whether investigators can corroborate the sources’ account with records or other evidence.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are federal investigators reported to suspect?
KrebsOnSecurity reports that investigators believe at least one executive at an unnamed U.S. consulting firm helped operate ShinyHunters’ extortion website, Shinywire. The report attributes the allegation to sources close to the investigation.
Has the suspected consulting executive been charged?
No. KrebsOnSecurity said it was not naming the firm or suspected executive because they had not been charged. The alleged role has not been established in court.
What did Shinywire do?
According to the report, the site listed nearly 100 organizations, urged them to negotiate payment and displayed samples of allegedly stolen data. It threatened publication if victims did not respond.
How does Edward Dubrovsky fit into the investigation?
The FBI arrested the Canadian cybersecurity executive on October 9, according to KrebsOnSecurity. Court records described by the outlet show charges alleging threats to disclose stolen or hacked data and extortion-related interference with interstate commerce. Those are allegations, not a finding of guilt.
What remains unknown about the FBI data breach?
The supplied report says ShinyHunters stole sensitive information from the FBI recruitment website, but does not establish the full scope of the breach, whether all threatened records were published or what the unnamed consulting executive knew about that incident.
Source: hn
