Brian Krebs reports that federal investigators suspect a U.S. consulting executive helped operate Shinywire, a website used to pressure ShinyHunters’ victims into paying. His October 19 investigation raises a second trust problem during a breach: who receives the victim’s recovery plans and negotiating limits?

Krebs attributes the website allegation to two sources close to the investigation. He withholds the U.S. company’s and executive’s names because they have not been charged. That allegation remains distinct from a conviction or a publicly established finding.

The responder can become another information channel

According to Krebs, investigators obtained communications between a ShinyHunters suspect and executives at ransomware-negotiation firms. Sources describe negotiators knowing details about victims before those organizations learned of their breaches.

Krebs separately reports the arrest and charging of Canadian cybersecurity executive Edward Dubrovsky. Charges are allegations. The report also carries Cypfer’s statement that it had no prior knowledge of his arrest and was unaware of being an investigation target.

These accounts do not establish that every negotiator, or every firm communicating with attackers, participates in extortion. Legitimate incident response can involve difficult communication with criminals. The concern is undisclosed alignment with the attacker and misuse of confidential client information.

A separate case establishes that the risk is real

In a July 9 sentencing announcement, the U.S. Justice Department describes Angelo Martino’s conspiracy with BlackCat ransomware actors. He received 70 months in prison after pleading guilty.

The department says Martino supplied attackers with confidential information about five victims’ negotiating positions and strategies. Attackers paid him to help maximize their proceeds. It also describes his participation in attacks against additional victims.

Evidence status: the Shinywire account is source-reported investigative suspicion; Martino’s separate BlackCat conspiracy resulted in a guilty plea and sentence. One case supports the general insider-risk concern without proving the other allegation.

Put oversight into the recovery plan

The practical exposure is organizational rather than version-specific. A negotiator may receive internal budgets, insurance limits, recovery options and sensitive communications while the victim is under pressure.

Krebs quotes CyberAcuView chief executive Mark Camillo criticizing fees calculated as a percentage of the ransom paid. CyberAcuView represents cyber insurers and has its own industry perspective. The incentive problem is nevertheless concrete: a larger payment can produce a larger fee.

Before granting access, organizations can build these checks into their response arrangements:

  • Request written fee and conflict disclosures. Ask about payment-linked compensation, referral arrangements and who benefits from the proposed course of action.
  • Keep independent authority over spending and disclosure. The person communicating with attackers should not alone decide what to pay or what internal information to reveal.
  • Limit access to client secrets. Share the information needed for a defined task, with records of who received it.
  • Preserve messages and decisions. Maintain an audit trail that counsel and an independent reviewer can inspect after the immediate crisis.
  • Keep recovery work separate from promises about stolen data. Tested backups can restore systems; payment cannot technically verify that every copy of stolen information was deleted.

These are governance measures drawn from the reported failure modes, not a claim that a particular fee structure proves criminal conduct.

The FBI’s May 15 ShinyHunters advisory warns affected individuals about harassment, impersonation and repeat use of stolen information. It recommends verifying unusual contacts through known channels, retaining evidence and refusing payment demands.

Caveat: Krebs’s unnamed-source allegations remain unresolved; the separate conviction does not establish guilt for anyone named or unnamed in the ShinyHunters investigation.