Dutch Signal logs tie US negotiator Dubrovsky to ShinyHunters FBI breach foreknowledge

Federal investigators obtained the logs after Dutch police arrested van der Stap while he remained logged into Signal. The chats document repeated exchanges between van der Stap, Dubrovsky, and an unnamed U.S. consulting executive who supplied victim details hours before breach notifications. Court filings list counts of extortion and interstate commerce interference against Dubrovsky; prosecutors cite the unreported FBI data as aggravating evidence.

Prior ShinyHunters leadership transitions from French operators to Rey in Jordan followed serial arrests tracked in Europol reports 2023-2025. The same pattern of negotiator foreknowledge appeared in the 2024 LockBit and 2025 RansomHub cases, where Canadian and U.S. firms were later named in sealed indictments. Data volume claims exceed $70 million in 2026 extortions per the FBI affidavit.

Operational consequence is immediate tightening of Signal and encrypted-app monitoring by ransomware task forces. Firms that previously advertised negotiation services now face de facto exclusion from victim representation once logs surface. Next step is sealed grand-jury review of the second U.S. executive's communications, with indictment threshold expected within 90 days.

Analysis of the timeline shows Dubrovsky published his extortion handbook 11 days after the fbijobs.gov breach, creating a documented conflict between public advice and private non-disclosure.