What’s new. KrebsOnSecurity reported on Oct 19 that, according to two sources close to the probe, FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating shinywire[.]com, the ShinyHunters victim extortion site. Krebs describes the firm as prestigious, with more than 1,000 associates, and is not naming it or the executive because no one has been charged. The site ran from about May 3 to Oct 16, 2026, and listed nearly 100 hacked organizations. Each entry posted samples of stolen files and told the victim to negotiate. Victims who didn’t engage within seven days had their data dumped on the group’s Tor leak blog.
How it surfaced. Dutch police arrested ShinyHunters suspect Pepijn van der Stap on Sept 15 while he was logged in to Signal, which let investigators read his recent chats. Per Krebs’ source, those chats show frequent contact with Canadian negotiator Edward Dubrovsky, who was arrested by the FBI and charged earlier this month, and with at least one executive at the U.S. consulting firm. The source says these negotiators often knew about new ShinyHunters victims before the victims did, and that the chats show Dubrovsky knew the group had stolen FBI personnel data and didn’t tell the bureau before ShinyHunters threatened to publish it. The FBI says ShinyHunters has extorted more than $70 million this year.
Why a security team should care. Most companies don’t pick their ransom negotiator in the moment. The cyber insurer’s panel usually does, and firms that refuse to facilitate payments tend to get swapped out once a victim decides to pay. Mark Camillo of CyberAcuView, the insurer consortium, told Krebs that negotiators who charge a percentage of the final payment have an obvious conflict of interest. This is now a pattern, not a one-off: DOJ charged MonsterCloud’s CEO on Oct 7 with allegedly paying hackers $8 million behind clients’ backs while billing them $19 million, and BlackCat collaborator Angelo Martino got 70 months in July. Coveware and Unit 221B have been warning victims not to pay ShinyHunters at all, and the group has been harassing their staff for it.
What we’d check. Pull your incident response retainer and your insurer’s panel list now, before you need them. Find out who would negotiate on your behalf, how they get paid (flat fee or a share of the ransom), and whether they have ever facilitated a ShinyHunters payment. Put a clause in the contract that bars contingency fees tied to ransom size and requires disclosure of crypto and exchange markups. Treat any outside party that knows about your breach before your own SOC does as an indicator of compromise. The FBI’s May 15 alert advises against paying ShinyHunters, since “deleted” data keeps coming back.