FBI probe ties ransom negotiators to ShinyHunters extortion

Krebs on Security reported on 19 October 2026 that US federal investigators pursuing the ShinyHunters hacking group identified executives at two ransomware negotiation firms who kept unusually close relations with it. According to sources close to the investigation cited in the article, one US-based executive helped operate the group's extortion website, Shinywire, which was active from about 3 May to 16 October 2026 and listed nearly 100 hacked organizations.

The investigation sped up after ShinyHunters hacked the FBI recruitment website fbijobs.gov in late September. On 9 October, Krebs on Security reported the FBI's arrest of a Canadian cybersecurity executive, since charged with threatening to disclose stolen data and with extortion. According to a source, the messages of a ShinyHunters suspect arrested in the Netherlands on 15 September showed that such executives often knew of new victims before the victims did. The FBI puts the group's extortion takings at more than $70 million so far this year.

The article also recalls that the US Department of Justice charged the head of a ransomware recovery firm on 7 October, alleging that he secretly paid ransomware groups $8 million while charging clients $19 million.

Why it matters The negotiator sits between victim and attacker and sees both sides' positions. When that role can be compromised, incident response contracts need explicit rules on fees, disclosure and conflicts of interest, and a decision to pay should never rest on one intermediary's word that stolen data will be deleted.