US and Canadian ransomware negotiators suspected of ties to ShinyHunters

Federal investigators are examining allegations that executives at two ransomware negotiation firms maintained unusually close relationships with the ShinyHunters hacking group. A US-based executive is suspected of helping operate a victim-extortion website, shinywire.com, which hosted individual extortion pages for nearly 100 organizations between May and October 2026.

The investigation gained momentum following the arrest of Pepijn van der Stap in the Netherlands. Authorities reportedly apprehended Van der Stap while he was logged into active Signal accounts, providing investigators with access to communications between the hacker and negotiators in Canada and the United States.

One of those individuals, Canadian cybersecurity executive Edward Dubrovsky, was arrested in Pennsylvania on federal cyber extortion and conspiracy charges. Investigators believe these negotiators may have possessed details regarding new ShinyHunters breaches before the affected companies were even aware of the compromises.