Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators allege executives at two ransomware negotiation firms had unusually close ties to ShinyHunters and that one U.S.-based executive helped operate the group’s extortion site, Shinywire. Arrests in September and October - including Dutch suspect Pepijn van der Stap and Canadian executive Edward Dubrovsky - came after authorities read Signal messages that showed frequent communications between ShinyHunters and negotiators, advance knowledge of new victims, and awareness that ShinyHunters had stolen highly sensitive FBI personnel records. ShinyHunters, now reportedly controlled by a teen hacker known as REY, has claimed dozens of breaches since 2019 and is said to have extorted more than $70 million this year; the FBI jobs-site hack included medical, psychological and Social Security data that prompted rapid law enforcement action and an unraveling of a suspected murder-for-hire plot linked to post-arrest messages.

Investigators say Shinywire, active roughly May-October 2026, listed nearly 100 victim organizations, published stolen samples, and pressured nonresponsive victims by moving data to a Tor-based victim-shaming site. The reporting details worrying overlap between incident response firms, insurance-driven choices about negotiators, and firms or individuals willing to facilitate ransom payments. Names tied to earlier ransomware dealings appear, including a Canadian executive linked to the alias “Ghostbyte” and past contacts with Dharma ransomware actors; companies named have denied prior knowledge, and legal exposure depends on sanction lists rather than payments per se.