OPINION
Edward Dubrovsky walked into the Philadelphia Cyber Risk Summit on Oct. 8 with his name on the sponsorship banner. His former company, Cypfer, was the event’s largest sponsor. He’d co-authored a book on ransomware negotiation. He was, by every visible measure, exactly the kind of person you call at 2 a.m. when your network is down and someone is demanding eight figures to give it back.
The FBI arrested him before the conference ended.
Dubrovsky, 54, now faces federal charges — conspiracy to extort, interference with commerce by threats — connected to the ShinyHunters investigation. The core allegation: The man organizations paid to negotiate against ransomware actors may have been on their payroll.
That’s not an individual misconduct story; that’s a program failure.
The FBI Got Hit the Same Way
ShinyHunters has been running the same operation for years. Credential theft. SaaS compromise. Data exfiltration. Extortion. By FBI estimates, they’ve pulled in over $70 million doing it.
Their most damaging target wasn’t a hospital or a bank. It was the FBI itself. An Accenture contractor running FBIjobs.gov had left a known Oracle PeopleSoft vulnerability unpatched.
ShinyHunters walked through it, moved laterally to AWS GovCloud, and exfiltrated somewhere between 2TB and 3TB of employee data — names, addresses, Social Security numbers, emergency contacts — including data from counterintelligence staff.
An Accenture contractor plus a known, unpatched vulnerability: The agency responsible for investigating third-party risk failures got hit by a third-party risk failure.
FBI Director Kash Patel confirmed the Dubrovsky arrest on Oct. 9. Two prior ShinyHunters arrests had already been made — Pepijn van der Stap in the Netherlands in September, and a 17-year-old known as “Rey” in Jordan on Sept. 29. Additional charges involving other incident response (IR) firms may follow.
Crisis Vendors Bypass the Entire Framework
Here’s what most post-incident coverage misses: Organizations that got hit didn’t fail at security. They failed at vendor management — specifically, vendor management for the one category of vendor that gets unlimited access to your worst day.
Everyday vendors go through a process. Cloud providers. Payroll processors. Data handlers. SOC 2 reports. Questionnaires. Contractual reps. Periodic reassessments. The process has gaps, but it creates friction — and friction catches things.
Crisis vendors skip all of it.
When ransomware hits at midnight, nobody pulls a vendor assessment. You call whoever your IR contact recommended, whoever answered when you searched, whoever had the right credentials on their website. The urgency is real — and that urgency is exactly what disables the controls you built to catch what Dubrovsky allegedly was.
Ransomware negotiators sit in the room where your most sensitive breach data lives. They talk directly to the threat actors. They advise on payment decisions. They know what was taken and what it’s worth on the market. And in most cases, the organization that hired them never ran a background check.
That’s a design failure rather than a vendor management gap. The framework assumes crisis vendors are on your side, but it has never actually tested that assumption.
Three Specific Failures
-
Credential verification: Dubrovsky’s LinkedIn profile listed him as a founder of Cypfer. Cypfer’s own spokesperson told reporters he was not a founder — he was a managing director who left the firm in November 2025. Organizations hired him based on a profile he wrote about himself, and nobody checked. In an industry where reputation is the entire product, self-reported credentials aren’t a vetting standard.
-
Conflict-of-interest screening: Ransomware negotiators maintain working relationships with threat actor networks. That’s how the job functions — not automatically disqualifying, but a real structural conflict that existing vendor questionnaires don’t address. Nobody asks: Does any principal of your firm have financial ties to threat actor groups? It’s not an unreasonable question. It’s just a question nobody asks.
-
Ongoing monitoring: Dubrovsky left Cypfer in November 2025. Organizations that hired him afterward — relying on his prior affiliation with a known firm — had no way of knowing his situation had changed. Vendor status isn’t static. A one-time onboarding review doesn’t capture it.
You Can’t Audit Your Way Out of This
Traditional third-party risk management (TPRM) was built by people trained in audit, contracts, and regulatory compliance. That background has real value. It’s also not sufficient for what this case represents. A cyber-literate TPRM analyst reads the same vendor differently. They know what it signals when a negotiation firm’s principals have professional networks that overlap with known threat actor infrastructure. They know what questions to ask about communication channels. They can evaluate whether a vendor’s claimed capabilities are technically plausible or just good marketing.
The Accenture breach at the FBI is instructive. An unpatched, known vulnerability isn’t exotic — it shows up in routine technical vendor assessments. A compliance-oriented review didn’t catch it. A technically aware reviewer would have.
A questionnaire doesn’t replace judgment. But you can build a team with the technical depth to exercise it.
What to Actually Do
-
Build your crisis vendor panel before the crisis. Vet IR firms, negotiators, and forensics vendors now — background checks on principals, conflicts disclosed in writing, affiliations verified. Refresh it annually. When the call comes at midnight, pull from a vetted list.
-
Do principal-level due diligence, not just entity-level. Entity vetting misses individual conduct. The people at firms with access to your breach data should clear the same bar as employees in sensitive internal roles.
-
Put the conflict-of-interest question in writing. Ask it. Require a signed answer. Enforce it.
-
Put cyber expertise inside the TPRM function. Not as an escalation path — as a standing competency on the team doing daily vendor oversight.
-
Review vendors after incidents, not just before. When a third party is involved in a significant incident, assess whether they performed as represented. Most organizations
discard that data. Stop discarding it.
Dubrovsky was on stage at a cyber risk conference — presenting as an authority on the problem he was allegedly part of — when federal agents pulled him out of it. The industry gave him the stage because his credentials looked right and nobody checked what was behind them.
Third-party risk programs exist to catch exactly this. The question is whether they get applied — with technical depth, to every vendor that gets inside the wire — or whether they remain a compliance exercise that breaks down precisely when it matters most.
The threat actor doesn’t respect the exception you carved out for urgent situations. That’s the gap they’re already in.
