THE piece reports the arrest of a prominent ransomware negotiator, Edward Dubrovsky, in connection with the ShinyHunters operation. Dubrovsky, who had been a high‑profile figure at a Philadelphia Cyber Risk Summit and co‑authored a book on ransomware negotiation, is accused of conspiring to extort and interfering with commerce by threats.
The article asserts the core allegation is that a crisis vendor hired to negotiate with threat actors may have been on the attacker’s payroll, illustrating a broader failure in vendor management for crisis vendors who gain access to an organisation’s most sensitive breach data and decision points.
The author argues that the incident exposes three failures: credential verification, conflict‑of‑interest screening, and ongoing monitoring of vendor relationships. It uses the FBI‑linked ShinyHunters case to illustrate how third‑party actors can exfiltrate large volumes of data, including sensitive personnel information, through compromised or inadequately vetted contractors such as an Accenture‑staffed FBIjobs[.]gov portal with a known unpatched vulnerability.
The piece cautions that traditional third‑party risk management centres on pre‑crisis checks, whereas crisis vendors operate outside those controls. Practical steps proposed include building a pre‑approved crisis vendor panel with principal due diligence, documenting conflict disclosures in writing, embedding cyber expertise within the risk management team, and conducting post‑incident vendor reviews to assess performance and risk signals. The article concludes that the industry must apply technical depth to vendor oversight, rather than viewing it as a mere compliance exercise.