BleepingComputer reported on October 10, 2026 that Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania in a federal case involving alleged cyber extortion activity. CyberScoop also reported the arrest the same day, and KrebsOnSecurity reported late October 9 that sources connected the case to the broader ShinyHunters investigation.
The public record is still incomplete. The complaint was reportedly sealed, and charges described in public court records are allegations, not findings. For business owners, the useful lesson is not to play courtroom analyst. It is to look at the people and firms that may receive authority during a ransomware incident.
When a company is under pressure, outside parties can move quickly into the response: cyber insurance contacts, breach counsel, forensic firms, negotiators, payment facilitators, MSPs, and communications advisers. That help can be valuable. It also means the owner needs a clear record of who is allowed to speak, approve, pay, preserve evidence, and explain decisions after the incident.
The business risk is authority without clarity
Ransomware response is not only a technical problem. It is a control problem. If a business has not defined roles before an incident, the company may be forced to make legal, financial, operational, and reputational decisions while stressed, offline, and short on facts.
That is where vendor accountability matters. A ransomware negotiation vendor, cyber extortion response firm, or breach coach may be one step away from sensitive data, threat actors, insurance decisions, and law-enforcement conversations. Owners do not need to become specialists in every part of incident response, but they do need a documented chain of responsibility.
Questions to ask before a crisis
- Who can contact an attacker? Ask whether only legal counsel, a named negotiator, or a designated incident lead can communicate externally.
- Who approves payment-related decisions? Define whether management, counsel, insurers, and law enforcement must be consulted before any ransom discussion moves forward.
- What conflict checks are performed? Request a written explanation of how response vendors screen for conflicts, subcontractors, prior relationships, and payment-channel risk.
- What evidence is preserved? Confirm that chat logs, payment discussions, file samples, timelines, and vendor recommendations will be retained in a usable record.
- How are MSPs and insurers coordinated? Make sure your IT provider, breach counsel, and insurer do not give the business conflicting instructions during the first day of response.
- When is law enforcement contacted? Decide in advance who makes that call and how the contact is documented.
What owners can review now
Start with the documents you already have: cyber insurance policy, incident response plan, MSP agreement, security retainer, and any breach-coach or forensic vendor language. Look for missing names, vague authority, unclear approval paths, and phrases that sound helpful but do not assign responsibility.
If your business has no ransomware incident plan, the next step is not a hundred-page binder. It is a short decision map: who leads, who calls counsel, who talks to the insurer, who works with the MSP, who approves spending, and who keeps the record. The plan should be simple enough to use on a bad day.
For New Jersey business owners, the practical takeaway is straightforward: do not wait until a cyber extortion event to find out who is holding the clipboard. Vendor help is most useful when authority, evidence, and accountability are already written down.
Sources and further reading
