U.S. Investigators Suspect Ransom Negotiator Helped Run ShinyHunters Extortion Site

U.S. investigators pursuing ShinyHunters reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group, including a U.S. executive suspected of helping operate its victim-extortion website, according to KrebsOnSecurity. The investigation intensified after ShinyHunters breached the FBI recruitment website and threatened to release sensitive personnel records. Authorities arrested alleged member Pepijn van der Stap and Canadian cybersecurity executive Edward Dubrovsky, while Jordanian authorities reportedly detained the group’s alleged leader, known as Rey. Recovered communications allegedly revealed advance knowledge of breaches and connections to ransom negotiators; the reported suspicions do not establish guilt.

The findings raise concerns about conflicts of interest when victims entrust intermediaries with ransom negotiations. KrebsOnSecurity also reported evidence that paying ShinyHunters does not reliably prevent renewed extortion, reinforcing the need to vet negotiators independently and avoid treating payment as assurance that stolen data will be deleted. Separately, Intuitive published a statement acknowledging a cybersecurity incident, but the available information does not establish a connection to ShinyHunters or the alleged negotiator misconduct.