Federal investigators suspect that an executive at a prestigious U.S. consulting firm took an active role in running an extortion website for the ShinyHunters hacking group, according to two sources close to the probe. The site, shinywire.com, operated from about May 3, 2026, until October 16 and listed nearly 100 hacked organizations. Each entry pressed victims to engage with the cybercrime group and negotiate payment terms, displayed samples of stolen files, and threatened to publish everything online if the victim ignored the demands. Victims that refused to engage within seven days would see all their stolen data posted on the ShinyHunters victim shaming blog, which is reachable only through the Tor anonymity network.
The same sources said investigators believe a second executive at the U.S. firm maintained unusually close relations with ShinyHunters. Neither the company nor the suspected executives are being named because no charges have been filed. The consulting firm has more than 1,000 associates. Messages from a Dutch hacker's Signal account reportedly showed that he spoke frequently with Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive arrested by the FBI on October 9, and with at least one executive at the U.S. firm, and that these executives often knew about new ShinyHunters victims before the victims themselves did.
Those messages also reportedly showed that Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers and never told the bureau before the group threatened on Twitter/X to publish deeply personal personnel files. The breach involved the FBI recruitment website fbijobs.gov, which ShinyHunters hacked in late September. The stolen files reportedly included medical and psychological records, Social Security numbers, home addresses, and information about each employee's unit and specialization.
Dubrovsky was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records. Prosecutors have asked that he remain in custody pending trial, and records in his case remain under seal, Politico reported. He recently published a book on handling cyber extortion that recommended always engaging with the hackers.
The arrests followed the September 15 detention of convicted hacker and ShinyHunters suspect Pepijn van der Stap in the Netherlands, where police reportedly used flash-bang grenades as he was logged in to various online accounts. Authorities arrested him while he was using his Signal account, letting them read recent communications. Sources said those messages were key to unraveling a murder-for-hire plot that emerged right after his arrest; Dutch outlet RTL reported the two murders were allegedly to be committed abroad and that there are indications Van der Stap gave the order, with no indication the orders were carried out. Reuters reported on October 3 that Rey, identified last year as a teenage hacker from Amman, Jordan, had been detained by Jordanian authorities and was cooperating with the FBI. According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.
More cybersecurity news from TechManNews.
