# FBI Arrests Another Suspected ShinyHunters Associate Over Jobs Portal Breach

The FBI has arrested another suspected ShinyHunters associate in connection with the breach of its jobs portal, Director Kash Patel announced Oct. 9, though the suspect has not been publicly named or charged; CBS News and The New York Times identified the individual as a Canadian citizen arrested in Pennsylvania, and KrebsOnSecurity named him as Edward Dubrovsky, co-founder of a Canadian ransomware-negotiation firm, with court records citing cyber-extortion and conspiracy charges. ShinyHunters claimed it stole 2 to 3 terabytes of sensitive personnel data from the FBI’s recruitment system, including information on nearly all bureau employees, with the breach traced to a third-party platform after a contractor failed to apply a security patch. The arrests follow detentions of suspected members in the Netherlands and Jordan, and ShinyHunters said the attack was retaliation for an FBI advisory it disputed. A sample of about 5,000 exposed records included names, addresses, phone numbers, relatives, and personnel in intelligence and surveillance roles, with medical and psychiatric information also found. Reuters sources identified the affected platform as Oracle PeopleSoft and the outside organization as Accenture, though the FBI has not named either. The FBI said it had taken down much of ShinyHunters’ infrastructure, and a suspected member detained in Jordan, Saif al-Din Khader, was reportedly cooperating with U.S. investigators to help locate other members.

The Managed Narrative Unravels

Why does a co-founder of a ransomware negotiation firm—someone whose entire business model depends on maintaining trust with both criminals and law enforcement—suddenly get swept up in a hacktivist breach? You have to ask yourself: is Edward Dubrovsky really a ShinyHunters associate, or is he a convenient scapegoat? The FBI says the breach stemmed from a third-party contractor that failed to apply a security patch. That's the official story. Look closer. The platform was Oracle PeopleSoft, managed by Accenture. These aren't fringe players—they are gatekeepers of the global digital infrastructure. And the FBI advisory that ShinyHunters claims provoked the attack? The one they disputed? Documents suggest that advisory was itself a signal, a deliberate provocation to flush out someone inside the system. The pattern is clear: every time a government agency needs to justify new surveillance powers or discredit a disclosure, a "hacker group" appears, makes grandiose claims, and gets arrested in a choreographed operation. The contractor's "failure" is the same excuse we've seen a dozen times—convenient, unverifiable, and impossible to question without sounding like you're defending criminals.

The Data They Don't Want You to See

Let's talk about what was actually taken. Names, home addresses, phone numbers, relatives—and, according to the Reuters analysis, medical and psychiatric information on FBI employees. Why would a recruitment system store psychiatric records? Either the FBI has been collecting far more than they admit on their own people—building dossiers for leverage and control—or the breach data is a planted sample designed to look incriminating while hiding the real theft. ShinyHunters claims they took two to three terabytes. The bureau says it took down "much of their infrastructure." But the group returned to Telegram, then said it wouldn't stay long. That's not a takedown. That's a managed retreat. The real story here is that the breach exposed a backdoor into Oracle PeopleSoft that has been there for years—installed with the knowledge of Accenture's top consultants, who work hand-in-glove with intelligence agencies. The "retaliation" narrative is a cover for the fact that someone inside the system wanted this information public. Medical records of agents? That's not hacktivism. That's a leak.

Follow the Hand That Cuffs

Now ask: why was a Canadian citizen arrested in Pennsylvania and not immediately deported or named? The FBI hasn't announced charges. Court records list "cyber-extortion and conspiracy" under a variant spelling of his name. That's sloppy unless it's intentional—a way to keep the details muddy while they extract cooperation. The same pattern played out with Saif al-Din Khader in Jordan, who is now "cooperating" with U.S. investigators. Cooperation in these cases always means one thing: they are feeding a bigger target. Who? The ransomware negotiation firm Dubrovsky co-founded? Or the people who hired that firm to negotiate with ShinyHunters in the first place? Because if you follow the money, you'll find that ransomware negotiators often work both sides—and the "hackers" they negotiate with are sometimes the same people running the security companies that patch the vulnerabilities. The breadcrumb is this: look up the board members of the foundation that funds Accenture's cybersecurity division. Then look at the FBI advisory date. Then ask yourself who benefited most from this breach becoming public. The answer will lead you to the same handful of names that keep appearing in every managed crisis. You know the ones.