ShinyHunters probe links negotiators to extortion site
ShinyHunters investigators suspect executives at two ransomware negotiation firms had unusually close relationships with the extortion group, including advance knowledge of victims and the alleged operation of its pressure website. KrebsOnSecurity reported that federal investigators believe at least one executive at a large U.S. consulting firm helped run shinywire[.]com, although neither the firm nor the suspected executive has been charged or publicly identified.
ShinyHunters has claimed dozens of major data breaches since 2019. Its original operators were primarily based in France, but arrests and prison sentences gradually shifted control of the name to a teenage hacker in Amman, Jordan, known as Rey. The FBI says the group has extorted more than $70 million from victims in 2026. Ransomware is malicious software or related extortion activity that blocks access to data, steals it, or threatens publication to force payment.
The investigation accelerated after ShinyHunters breached fbijobs.gov in late September. The stolen recruitment files reportedly included medical and psychological records, Social Security numbers, home addresses, and details about employees’ units and specialisations. The group then threatened on Twitter/X to release the information. Reuters reported on October 3 that Jordanian authorities had detained Rey and that the teenager was cooperating with the FBI.
Dutch authorities had arrested another suspected senior ShinyHunters member on September 15. Police reportedly used flash-bang grenades while trying to detain him as he remained signed in to several online accounts. A source close to the investigation said officers gained access to his Signal messages and could read recent conversations with frequent contacts, including ransomware negotiators in Canada and the United States. Multiple sources told KrebsOnSecurity those messages also helped uncover an alleged murder-for-hire plot involving two planned killings abroad. RTL reported there was no indication the alleged orders were carried out.
On October 9, the FBI arrested a 54-year-old Canadian cybersecurity executive in connection with the ShinyHunters investigation. Court records charge him with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. Prosecutors have requested that he remain detained pending trial, while records in the case remain sealed. The allegations have not been tested at trial.
A source told KrebsOnSecurity that the Dutch suspect had communicated frequently with the Canadian executive and at least one executive at a major U.S. consulting firm. According to that account, the negotiators sometimes knew details of new ShinyHunters breaches before the affected organisations did. The same messages allegedly showed that the Canadian executive knew sensitive FBI data had been stolen but did not notify the bureau before the group publicly threatened publication.
Shinywire operated from approximately May 3 until October 16 and listed nearly 100 organisations allegedly breached by ShinyHunters. Its pages displayed samples of stolen files, urged victims to discuss payment, and threatened publication if they did not respond. Organisations that refused to negotiate within seven days were told their data would appear on a victim-shaming site accessible only through Tor, a network designed to conceal where users and websites are located. One indexed page targeted medical technology company Intuitive Surgical, breached in March 2026 after a targeted phishing email, a deceptive message designed to steal login details, compromised an employee’s credentials.
KrebsOnSecurity also described an older connection between ransomware criminals and an executive formerly associated with Cypfer. Former colleagues said the executive had been known as Ghostbyte. In 2018, a Dharma ransomware representative directed a Canadian victim seeking payment guarantees to ghostbyte@tutanota.com and described the contact as an IT company that often handled such problems. It remains unclear whether the executive ever controlled that address. Constella Intelligence found that another address frequently used by the executive was linked to two accounts using the username ghostbyte. It also linked the Dharma representative’s address to a cryptocurrency wallet, an online account for digital currency, that processed 38 transactions totalling 43 bitcoin, worth about $3.5 million at the value cited in the report. Its most recent transaction was in February 2019.
The Canadian executive arrested in October had previously worked at Cypfer and later at CyberSteward. Cypfer said it does not make or facilitate ransomware payments, learned of the arrest through media reports, had not been contacted by law enforcement, and was not aware of being under investigation. It said Cypfer and CyberSteward have no officers, directors or employees in common. The statement also noted that Cypfer was acquired by Apros Group. Separately, litigation in Ontario contains disputed claims between the arrested executive and a former business partner concerning confidential information, competition and their respective roles at Cypfer.
Paying a ransom for access to encrypted systems or a promise that stolen data will be deleted is not generally illegal in the United States. A payment can create legal exposure if it goes to an organisation sanctioned by the U.S. Treasury Department, but ShinyHunters is not currently sanctioned by the United States or another government. The larger practical problem is that victims cannot technically verify that criminals destroyed every copy of stolen information.
PowerSchool illustrates that risk. ShinyHunters began extorting the education technology company in December 2024 after stealing information concerning 62 million students and 9.5 million teachers in the United States and Canada. PowerSchool reportedly paid $2.85 million with assistance from CyberSteward. A 20-year-old ShinyHunters affiliate was later sentenced in November 2025 to four years in prison for his admitted role. By May 2025, school districts were receiving new demands based on samples from the same stolen files, although nobody has alleged that ShinyHunters conducted that second wave.
Incident response firms, companies that help organisations contain and recover from cyberattacks, do not all agree to facilitate payments. Coveware and Unit 221B have repeatedly advised victims not to pay ShinyHunters because supposedly destroyed data may be retained, sold or used to extort customers later. The FBI issued similar advice on May 15, 2026. Private Telegram messages shared with KrebsOnSecurity show ShinyHunters blaming Coveware for reducing payment rates and discussing efforts to eliminate what it called the problem. The group has also harassed and threatened employees at both firms.