# The Rise of ShinyHunters: How a Hacker Collective Turned Data Theft Into a $70 Million Extortion Empire
## A Cybercrime Group That Redefined Ransomware
Over the past several years, a hacker collective known as ShinyHunters has grown from a ragtag group of cybercriminals operating out of France into one of the most financially devastating extortion networks on the planet. Since 2019, the group has claimed responsibility for dozens of major data breaches, targeting organizations across the globe and amassing an estimated $70 million in ransom payments from victims in 2026 alone.
What sets ShinyHunters apart is not just the scale of its operations, but the sophisticated ecosystem it has built around itself — including ties to professional cybersecurity firms, ransomware negotiators, and a troubling pattern of insider knowledge that raises serious questions about conflicts of interest in the cyber response industry.
## How It All Began
ShinyHunters first made headlines in 2019 when its original operators, living in France, began carrying out large-scale data thefts and extortion campaigns. The group targeted corporations, government agencies, and educational institutions, stealing sensitive data and using the threat of public exposure as leverage for ransom payments.
As French law enforcement closed in and the original members were arrested or jailed one by one, control of the ShinyHunters brand shifted to a new figure: a teenage hacker from Amman, Jordan, known by the alias “Rey.” Under Rey’s leadership, the group expanded its operations dramatically, developing a professional-grade extortion infrastructure that included a dedicated victim-facing website where targeted organizations could view samples of their stolen data and negotiate payment terms.
## The FBI Breach That Changed Everything
In late September 2026, ShinyHunters struck at one of the most high-profile targets imaginable — the Federal Bureau of Investigation itself. The group breached the FBI’s recruitment website, **fbijobs.gov**, and stole highly sensitive personal information about FBI employees.
The stolen data reportedly included medical and psychological records, Social Security numbers, home addresses, and detailed information about each employee’s unit and area of specialization. Rather than quietly covering the breach, ShinyHunters taunted the agency publicly on social media, threatening to release the stolen files if their demands were not met.
This brazen attack prompted the FBI to take swift and unprecedented action. Federal investigators moved quickly to identify and apprehend anyone who had been in communication with Rey or other members of the group, leveraging digital evidence gathered from encrypted messaging platforms.
## The Arrests That Unraveled the Network
Two high-profile arrests in September and October 2026 proved to be the turning points in the investigation.
### The Dutch Connection
On September 15, 2026, Dutch authorities arrested **Pepijn van der Stap**, a convicted hacker and suspected senior member of ShinyHunters. Dutch police reportedly used flash-bang grenades to stun and apprehend Van der Stap while he was logged into his online accounts, giving investigators immediate access to his encrypted messaging communications.
Those messages proved invaluable. Van der Stap’s Signal conversations revealed extensive contact with ransomware negotiators based in both Canada and the United States — negotiators who, according to sources, often knew the details of new ShinyHunters victims before the victims themselves were even aware of the breach.
### The Canadian Executive
Shortly after Van der Stap’s arrest, the FBI arrested **Edward Dubrovsky**, a 54-year-old Canadian cybersecurity executive, on October 9. Dubrovsky faced federal charges including threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion.
Court records revealed that Dubrovsky had known ShinyHunters had stolen sensitive data from FBI servers but never informed the bureau before the group publicly threatened to publish the agency’s personal files. Prosecutors requested that Dubrovsky remain in custody pending trial, and records related to his case were sealed.
Dubrovsky had previously authored a book on handling cyber extortion that advocated always engaging directly with hackers. His arrest raised broader questions about the role of professional negotiators and cybersecurity consultants in facilitating ransom payments.
## The Extortion Website and Its Operators
Investigators discovered that ShinyHunters operated a now-defunct website called **shinywire.com** from approximately May 3 to October 16, 2026. The site listed nearly 100 organizations that had been hacked by the group, each page displaying samples of stolen files and pressuring victims to negotiate payment terms.
Federal investigators believe that at least one executive at a major U.S.-based consulting firm played an active role in running the website. While KrebsOnSecurity has chosen not to name the firm or the individuals involved because no charges have been filed, the company is described as a prestigious firm with more than 1,000 associates.
Victim organizations that refused to negotiate were given a seven-day deadline, after which their stolen data would be published on a separate extortion blog accessible only through the Tor anonymity network.
One notable victim listed on the site was **Intuitive Surgical**, the American medical technology company that was breached in March 2026 after an employee fell for a targeted phishing email. The attack compromised the company’s network and gave ShinyHunters access to sensitive corporate data.
## The “Ghostbyte” Connection
Another figure with deep ties to the ransomware underworld is **Daniel Tobok**, the former CEO of **Cypfer**, a cybersecurity firm founded in Toronto with international offices. Tobok has reportedly been known in ransomware circles by the nickname “Ghostbyte” for at least eight years.
The connection traces back to 2018, when a Canadian company was attacked by Dharma ransomware, a prolific Russian-language ransomware program. In that case, the Dharma attackers specifically recommended the victim contact a Canadian IT company for guarantee services, providing the email address **ghostbyte@tutanota.com**.
Investigators found that Tobok’s regular email address, **dtobok@me.com**, is linked to multiple online accounts using the username “ghostbyte,” including a Snapchat profile. While it remains unclear whether Tobok ever used that specific address, the overlap has raised significant questions about his potential role in facilitating ransomware payments over the years.
## Corporate Ties and Conflicts of Interest
The investigation revealed a web of corporate relationships that blur the line between cybersecurity defense and ransomware facilitation.
Cypfer was recently acquired by the **Apros Group**, a holding company led by Jason Hogg — a former FBI special agent and former CEO of **Aon Cyber Solutions Group**. Years earlier, in 2020, Aon had acquired **Cytelligence**, a security consulting firm where Tobok served as founder and CEO and where Dubrovsky was a managing partner.
Dubrovsky, for his part, filed a lawsuit against Tobok in Ontario, claiming he had been gradually excluded from Cypfer’s business operations and that Tobok made increasingly erratic decisions. Tobok denied the allegations and filed a counterclaim, accusing Dubrovsky of misusing confidential information and unfairly competing with Cypfer through his work at **CyberSteward Inc**, a separate company.
Cypfer stated publicly that its business does not include facilitating ransomware payments and that the company learned of Dubrovsky’s arrest from media reports, not from law enforcement.
## The PowerSchool Case: A Cautionary Tale
One of the most instructive examples of ShinyHunters’ modus operandi involves the education technology company **PowerSchool**. In December 2024, ShinyHunters stole private information on approximately 62 million students and 9.5 million teachers across the United States and Canada.
PowerSchool reportedly paid a $2.85 million ransom to retrieve encryption keys for its locked systems. However, the payment did not prevent follow-up extortion attempts. By May 2025, individual school districts were receiving separate ransom demands using the same stolen data — proof that there is no technical way to verify that attackers have truly deleted what they stole.
PowerSchool was assisted in its ransom payment by **CyberSteward**, the same firm connected to Dubrovsky and Tobok. Separately, ShinyHunters affiliate **Matthew Lane**, age 20, of Sterling, Massachusetts, was sentenced in November 2025 to four years in prison for his role in the PowerSchool breach.
## Industry-Wide Concerns
The ShinyHunters case has exposed systemic problems in how organizations respond to ransomware attacks.
### The Conflict of Interest Problem
Many ransomware incident response firms charge a percentage of the final ransom payment as their fee. This creates a direct financial incentive to advise victims to pay — and to negotiate higher amounts — rather than pushing for alternatives like data recovery or law enforcement engagement.
Mark Camillo, CEO of CyberAcuView, an industry group founded by major cyber insurance carriers, said this practice is deeply problematic. “There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself,” Camillo said.
### Firms That Say No
Leading cyber incident response companies like **Coveware** and **Unit 221B** have consistently advised victims against paying ShinyHunters, warning that destroyed data is often retained, resold, or reused for future extortion.
ShinyHunters leaders were furious about this advice. Internal communications reviewed by investigators showed the group complaining that Coveware was ruining their payment rates, with one member writing: “Someone is going out of their way to make sure I am not paid.”
In another exchange, the group explicitly stated they were “trying to eliminate the problem” — referring to the advisory firm discouraging payments.
### DOJ Crackdowns on Negotiators
The U.S. Department of Justice has intensified its prosecution of ransomware negotiators accused of colluding with cybercriminals.
On October 7, the DOJ charged **Zohar Pinhasi**, CEO of **MonsterCloud**, with wire fraud and conspiracy. Prosecutors alleged that Pinhasi charged customers to remediate ransomware attacks but secretly paid hackers behind his clients’ backs, paying $8 million to attackers while charging customers $19 million.
Earlier, in July, **Angelo Martino**, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware group. Martino was paid by the attackers to provide confidential details about his clients’ negotiating positions, enabling the criminals to maximize their ransom demands.
## The Broader Picture
The ShinyHunters case illustrates how cybercrime has evolved from a lone-wolf hacker activity into a complex, multi-layered ecosystem involving negotiators, consultants, insurance providers, and even some cybersecurity firms.
Key takeaways from the investigation include:
– **Insider knowledge is rampant.** Executives at consulting firms reportedly knew about breaches before victims were notified.
– **Ransomware payment facilitation is a growing industry** with questionable ethical standards and hidden financial incentives.
– **Data is never truly destroyed.** Victims who pay may recover encrypted files but cannot prevent future misuse of stolen information.
– **Law enforcement is adapting**, using encrypted messaging evidence and international cooperation to dismantle hacker networks.
## FAQ
**What is ShinyHunters?**
ShinyHunters is a hacking group that has been active since 2019, specializing in data theft and extortion. The group has claimed responsibility for dozens of major data breaches and has extorted millions of dollars from victims worldwide.
**Who leads ShinyHunters now?**
The group is currently led by a teenage hacker from Amman, Jordan, known by the alias “Rey,” who assumed control after the original French members were arrested or jailed.
**Why was the FBI recruitment website breach significant?**
The breach of fbijobs.gov was notable because it targeted federal law enforcement itself, exposing sensitive personal data about FBI employees including medical records, Social Security numbers, and detailed employment information.
**What happened to Pepijn van der Stap?**
Van der Stap was arrested by Dutch authorities on September 15, 2026, while logged into his Signal messaging account. His encrypted communications provided critical evidence linking him to ShinyHunters and to ransomware negotiators in Canada and the United States.
**What was Edward Dubrovsky accused of?**
Dubrovsky, a Canadian cybersecurity executive, was charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. He allegedly knew about the FBI data breach but did not inform the bureau before ShinyHunters publicly threatened to release the files.
**What is the Ghostbyte connection?**
Ghostbyte is the nickname for Daniel Tobok, former CEO of Cypfer, who has been known in ransomware circles for years. Investigators found ties between his email addresses and accounts linked to ransomware referral activity dating back to 2018.
**Why do some cybersecurity firms have conflicts of interest?**
Certain incident response firms charge a percentage of the ransom payment, creating a financial incentive to advise clients to pay rather than pursue alternative solutions. Industry experts are calling for greater transparency around these fee structures.
**Can paying a ransom guarantee data safety?**
No. The PowerSchool case demonstrated that even after a ransom was paid, stolen data was used in subsequent extortion attempts against the same victims. There is no technical way to verify that attackers have deleted stolen files.
**What is the U.S. Department of Justice doing about this?**
The DOJ has been prosecuting ransomware negotiators for conspiring with hackers, including charging MonsterCloud’s CEO for defrauding customers and sentencing a negotiator for collaborating with the BlackCat ransomware group.
**How can organizations protect themselves from ransomware groups like ShinyHunters?**
Experts recommend robust cybersecurity defenses, regular employee training on phishing, maintaining offline backups of critical data, having a tested incident response plan, and carefully vetting any third-party firms involved in breach response — especially regarding their fee structures and relationships with ransomware groups.
## Conclusion
The ShinyHunters investigation has peeled back the layers of a sophisticated cybercrime ecosystem that extends far beyond a handful of hackers operating from a laptop. It has revealed a network of negotiators, consultants, and corporate advisors whose financial incentives may not always align with the best interests of the victims they claim to serve.
The arrests of key figures in 2026 have dealt a significant blow to the group’s operations, but the broader problem — of insider knowledge, conflicting interests, and the exploitation of victims’ desperation — remains deeply embedded in the cybersecurity industry.
As law enforcement agencies around the world continue to collaborate on this case, the ShinyHunters saga serves as a stark reminder that in the digital age, data is both a weapon and a vulnerability, and that the line between defense and facilitation is far thinner than most organizations realize.
Thank you for reading
