The FBI has arrested a former cybersecurity executive of the firm that was tasked with helping Hamilton recover from a 2024 cyberattack, but the company says he had no involvement in the work it did for the city.
Ed Dubrovsky, a former managing director at CYPFER, was arrested in Philadelphia earlier this month. The Canadian is accused of being linked to ShinyHunters, a cybercrime hacking group.
The company told CBC News in an emailed statement that Dubrovsky wasn’t involved in the Hamilton file.
“According to our case notes, Mr. Dubrovsky did not perform any work on this case. The engagement was handled by CYPFER’s delivery team.”
Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case
FBI Director Kash Patel, in a social media post, previously described the person arrested as a “suspected co-conspirator” in a cyberattack involving FBIjobs.gov. U.S. court documents outline two criminal charges against Dubrovsky, including conspiracy to threaten to impair the confidentiality of information with the intent to extort money and interference with commerce by threats.
The allegations have not been proven in court.
Dubrovsky was managing director of CYPFER between May 2022 and December 2025, according to the company. After the February 2024 ransomware attack, Hamilton hired the firm, as a retained technical advisor, through the city’s legal counsel.
The attack shut down almost all of the city’s phone lines, paralyzed city council and impacted dozens of services, including the bus schedule app, library WiFi and permit applications. No personal information was stolen, the city said.
The attackers demanded that the city pay $18.5 million to unlock city systems, but Hamilton didn’t pay the ransom.
The city had spent at least $18.3 million on “immediate response, system recovery and third-party expert support” as of June 30, 2025, it said. As of March 2026, it had spent or committed $22.9 million of a total $47.7 million approved for addressing gaps exposed by the attack.
CYPFER said Dubrovsky has had no affiliation or operational role with the company since leaving at the end of 2025.
Canadian ransomware negotiator arrested in connection to FBI hacking case
The City of Hamilton said it was aware of media reports about the arrest, but could not comment on the allegations.
“As this is a legal matter involving another jurisdiction, the city cannot comment on the allegations or the individual’s circumstances,” it told CBC Hamilton in an email.
“Cybersecurity is a primary focus for the city and we continue to strengthen our systems, processes and safeguards to better protect municipal services and information for everyone who lives, works and invests in Hamilton.”
Cybersecurity analyst Ritesh Kotak told CBC News last week that the arrest has created “a sense of shock” for the cybersecurity community.
Kotak said Dubrovsky is “very popular” and has spoken at numerous conferences, but stressed that the charges “are clearly just allegations” and that it is not yet known “what exactly has happened.”
“This is an individual that was for the most part respected when it came to ransomware negotiations,” he said. “A lot of people are familiar with his work as well.”
Dan Mathieson, senior adviser at Toronto Metropolitan University’s Rogers Catalyst Cybersecure Institute, said the allegations could shake confidence in cybersecurity experts hired to help organizations recover from attacks.
“It’s quite shocking,” Mathieson told CBC Hamilton. “This is an out-of-the-blue story that really speaks to the heart of trust at a time when trust in institutions, and in security and technology are at an all-time low.”
Mathieson is no stranger to cyberattacks.
As mayor of Stratford, his town was forced to pay over some $75,000 worth of Bitcoin in exchange for decryption keys to unlock its information systems following a 2019 cyberattack.
He said the difficult moments that municipalities, non-governmental organizations and charities face after a cyberattack highlight the importance of cybersecurity specialists.
Those involved in ransomware negotiations can communicate with attackers, assess what information has been taken, and help clients weigh the costs and risks of paying a ransom, Mathieson said.
They can also help organizations determine what data might be recovered and what steps are needed to restore affected systems.
“Having someone of that significance be indicted and charged is very chilling,” Mathieson said.
He said the allegations could prompt organizations to review how they vet outside experts, including their credentials, certifications and criminal background checks.
“It will lead to a lot of thinking around this and probably a revamp in how you choose your experts that are going to work in these files.”
