FBI Arrests Cybersecurity Executive Over Data Breach After Contractor Fails to Update Oracle HR Platform (cnn.com) 57
CNN reports:
The FBI arrested a Canadian cybersecurity executive and ransomware expert as part of the investigation of a damaging hack that exposed the sensitive data of current and former FBI employees, according to court documents and people familiar the investigation. Edward Dubrovsky was arrested in the Philadelphia area in recent days... Dubrovsky is facing charges related to extortion and making threats. He has been transferred to Texas's Eastern District for a scheduled detention hearing, according to court records and a law enforcement official.
FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or what role the man is suspected of playing in the hack. Patel also didn't name Dubrovsky, but CNN confirmed the defendant is believed to be tied to the FBI hack through multiple people familiar with the investigation... A LinkedIn profile under Dubrovsky's name lists years of experience in the Canadian cybersecurity industry and describes Dubrovsky as a 'globally recognized cybersecurity expert.' An Ed Dubrovsky is also the author of a book on handling ransomware negotiations with cybercriminals...
There has also been an inquest at the FBI over how such a critical security lapse happened. The FBI determined that a contractor managing the bureau's jobs portal failed to update software "explicitly issued to secure the platform," [senior FBI cyber official, Brett Leatherman said last week]. The FBI has "removed the contractor," he said. The software in question is a human-resources platform made by Oracle, ShinyHunters has said. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software.
"The inmate locator at the U.S. Bureau of Prisons website reports that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia," reports security researcher Brian Krebs.
Thanks to long-time Slashdot reader schwit1 for sharing the news.
FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or what role the man is suspected of playing in the hack. Patel also didn't name Dubrovsky, but CNN confirmed the defendant is believed to be tied to the FBI hack through multiple people familiar with the investigation... A LinkedIn profile under Dubrovsky's name lists years of experience in the Canadian cybersecurity industry and describes Dubrovsky as a 'globally recognized cybersecurity expert.' An Ed Dubrovsky is also the author of a book on handling ransomware negotiations with cybercriminals...
There has also been an inquest at the FBI over how such a critical security lapse happened. The FBI determined that a contractor managing the bureau's jobs portal failed to update software "explicitly issued to secure the platform," [senior FBI cyber official, Brett Leatherman said last week]. The FBI has "removed the contractor," he said. The software in question is a human-resources platform made by Oracle, ShinyHunters has said. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software.
"The inmate locator at the U.S. Bureau of Prisons website reports that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia," reports security researcher Brian Krebs.
Thanks to long-time Slashdot reader schwit1 for sharing the news.
Just like cops (Score:2, Insightful)
Study the bad guys, get a job interacting with illegal activities, and you too can become corrupt.
Re: (Score:3, Insightful)
From reading the excerpt, it seems this was negligence though, not becoming the bad guy -- which requires malice as the main ingredient. More like being reckless/careless which requires stupidity as the main ingredient.
Re: (Score:2)
From reading the excerpt, it seems this was negligence though, not becoming the bad guy -- which requires malice as the main ingredient. More like being reckless/careless which requires stupidity as the main ingredient.
From reading the summary it does not sound like the guy arrested was part of the negligence?
Re:Just like cops (Score:4, Insightful)
Maybe you didn't read as far as the third sentence of the summary:
Dubrovsky is facing charges related to extortion and making threats.
That's not negligence or carelessness. The title is poorly worded.
Re: (Score:2)
You're right .. I missed that. Next time I should read instead of skim.
Re:Just like cops (Score:4, Interesting)
Re: (Score:3)
Re: (Score:2)
No, the US isn't going to "go military" on Canada. Trump just likes to talk big. Read all about his negotiating style, he literally wrote a book about it. https://www.amazon.com/Trump-A... [amazon.com]
Re: (Score:2)
Re: (Score:2)
Sounds like we agree then.
Re:Just like cops [driving in reverse] (Score:2)
That was the angle I was looking for in the discussion. Whenever I think about Patel in charge, this ol' classic video comes to mind: https://youtu.be/MdnH6m054as?s... [youtu.be] So now I'm wondering about whether this guy had the right political connections separate from the connections he may have had to the criminals...
On the other hand, it is true that the weakest link in any chain of security is likely to be a human being... However the way the FBI works now, I'm back to wondering if perhaps he was just the easie
Re: (Score:1)
Who knows what the real story is. The whole thing with its vague accusations sounds a lot like scapegoating to me.
You started on the right track, but suddenly and inexplicably jumped off the cliff.
If it isn't clear what the real story is... maybe you should learn to accept that? And be in a state of knowing ignorance? It's the most common state, and the most important state. "I do not yet know." Anything you think about, you should be able to rapidly go into details that you don't know, but if you did know you could follow the chain further. And then to stop.
Instead, when you get to end of what you know, you make a pre
Re: (Score:3)
Cases like this make me think back to law enforcement back after 9/11 arresting people for 'hoax devices', meaning anything the jump scared police thought might be interpreted as bomb was the person trying to convince them that it was. So I always take their claims that someone 'meant to do something' that emnbarassed them might not be the case.
Re: (Score:1)
Maybe you didn't read as far as the third sentence of the summary:
Dubrovsky is facing charges related to extortion and making threats.
That's not negligence or carelessness. The title is poorly worded.
Unfortunately with this admin and FBI, there's about a 110% chance that those charges are completely fabricated -- especially since this company is from the US's mortal enemy, Canada.
Or someone with an agenda infiltrating (Score:1)
Study the bad guys, get a job interacting with illegal activities, and you too can become corrupt.
Or start out a bad guy, get a job in government, screw things up from the inside.
Re:Just like cops (Score:5, Interesting)
According to Malcolm Gladwell, Berlin has something like twice the number of police as LA. Other Euro cities are similar. Their cops have a much better reputation. After studying the matter, his conclusion is that the reason American cops are more violent and ornery is they are simply undermanned and overwhelmed.
He studied Baltimore recently. Baltimore used to be one of the most violent cities in America. The new mayor has cut crime tremendously. The reason, he hired more cops and other personnel. His anecdote was that when a person was recently murdered, the mayors people paid a visit to his family and iced their belief they needed to go out and exact revenge. They did it by combination of explaining the bad outcomes and their police were on the case.
I put this down to the R's whining incessantly about crime but then stiffing city budgets when it comes to hiring police. In short, the R's help cause the problem so they can continue to whine incessantly about it.
Re:Just like cops (Score:5, Informative)
Insufficient training is also one of the reasons. In Berlin, even the beat cop training takes 30 months. LAPD academy trains their recruits for 6 months.
Re: (Score:2)
In Germany, police are taught to de-escalate, to find solutions, more psych tests (to weed out corruption, racial bias and a host of other things).. and when and how to shoot if and when necessary.. (and when necessary is a small window of genuine threat)
In the US, the police are taught that the gun is the solution for all issues, and to roll with your "Feelings" and that anyone gives you grief, the police have got your back. So honestly not that much training is needed
I've seen li
Re: (Score:2)
Re: (Score:3, Insightful)
Just to avoid the chances of getting eye-cancer from your 4chan vomit, I have asked AI to reply:
1. Correlation vs. Causation (Economics over Ideology):
Single motherhood correlates with youth delinquency primarily through household poverty and resource strain, not gender or partisan ideology. When studies control for household income, neighborhood safety, and educational access, the gap between single-mother and single-father or two-parent outcomes shrinks dramatically. Attributing systemic poverty to "toxic
Re: (Score:2)
Blaming single mothers for absent fathers while lecturing about "accountability" is a contradiction.
Glad I'm not the only person who noticed.
Gladwell is one of the worst hacks in the country (Score:1)
That said this is just wrong and he's probably getting paid to say it.
Police in Europe are completely different. They're trained differently and they are treated differently. They are also used for different purposes. Policing in America is primarily a way for us to enforce social order. Not legal order social order. That is much less of a thing in Europe. They don't have that massive underclass
Re: (Score:2)
My first thought was that he was arrested because he was Canadian. I'm not sure that I trust the FBI to be honest. OTOH, it's reasonable that no real evidence was presented yet.
My second thought was "who planted the evidence framing him?". This again is lack of trust in the FBI, but here it's their competence I'm doubting.
My third thought was "maybe the evidence actually points to him". It's really sad that the government lies so much that that didn't show up until the third thought...but it DOES lie th
We need a modern version of Adm Hopper ... (Score:3, Interesting)
The software in question is a human-resources platform made by Oracle, ShinyHunters has said. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software.
We need a modern version of Admiral Grace Hopper to review and modernize government IT. This idiocy is likely the tip of the iceberg.
Re:We need a modern version of Adm Hopper ... (Score:5, Informative)
We need a modern version of Admiral Grace Hopper
We had one:
https://en.wikipedia.org/wiki/... [wikipedia.org]
It was a pretty damn effective, with quite a few people who, like Grace Hopper, valued service to the country over the higher salaries they could have made in the private sector.
The DOGE clowns blew it up:
https://www.cybersecuritydive.... [cybersecuritydive.com]
Trump created CISA, wants it to focus (Score:1)
CISA was created by Trump during his first administration to "defending federal networks and protecting critical infrastructure"
It was not blown up in the 2nd term, it had its budget reduced, and it was told to focus on its core mission (above). The budget cut was due to identified bloat and expansions into political realms. The administration wanted it to focus on the technical mission is was created for.
Re: (Score:2)
Just get Claude to do it, right???
Modern versions of Adm Hopper and Adm Rickover (Score:1)
Just get Claude to do it, right???
Modern IT infrastructure and tools may need a Admiral Grace Hopper like individual for oversight,
but AI needs an Admiral Hyman Rickover like individual for oversight.
Re: (Score:3)
Oracle has faced a sharp surge in automated and AI-driven critical vulnerability discoveries throughout 2026, pushing their Critical Security Patch Updates from a quarterly cadence to a monthly cycle.
High-profile RCE vulnerabilities across Oracle enterprise stacks—such as deserialization flaws in PeopleSoft or CVE-2025-61882 in EBS—stem from unauthenticated web application weaknesses, insecure Java deserialization, path traversal, and exposed endpoints that allow remote exploit execution.
While m
So the FBI's response to cybercrime is... (Score:4, Funny)
News media leaks and doxxes people now? (Score:4, Insightful)
Is this considered normal and usual that the US news media doxxes potential suspects even before anything official has been published or a verdict has been found?
They seem to be able to get away with it too, and direct psychological and physical violence of insane pseudo-vigilante hate mobs like we saw with the holdout juror.
Re: (Score:2)
A verdict? When did the news media *ever* wait for a verdict?
The wheels of justice turn slowly. If we waited for a verdict before a crime or alleged crime became news, we'd be waiting *years* in many cases.
Also, the legal standard for a conviction is intentionally heavily tilted towards the person being charged. It is *supposed* to be hard to convict someone. That is different from being actually guilty. Many people who committed crimes get away with them because there isn't enough evidence. That does not m
Re: (Score:2)
Something official was published. In particular, he had a court hearing where he was ordered transferred to the district where he was charged.
So what sort of toxic dictatorship do you hail from where the media isn't allowed to report on court cases?
Are you sure you've actually considered the historical results in places that have used that sort of system?
When the government arrests you on some ridiculous pretext... don't worry, nobody will know, nobody will demand justice, nobody will independently investig
Re: News media leaks and doxxes people now? (Score:2)
As a counter example to your BS: no normal European country would allow the public to find out who has been arrest or questioned. There are no public mugshots either. The entire system heavily enforces the initial assumption of innocence until proven guilty. It would be unthinkable to throw someone to the mob-rule like that by doxxing them.
Do your alfabetrainbow bars publish lists of visitors? Or hospitals publish STD-treatments? Or churches publish the names of their community?
You still dont see any issue
Re: (Score:2)
Europe has had a huuuuuge fairly recent problem with secret arrests and people "disappearing" (executed) without any records.
You're a fucking moron if you think it is good for that to be secret. It puts you on the side of murderous dictators.
And what benefit do you get? You're merely too childish not to punish people for being found innocent of a crime? Fucking morons.
You can't tell the difference between arrest records and hospital records? Wow. You're stupider than I imagined.
You thought churches were pub
Time to fabricate evidence (Score:2, Interesting)
While Dubrovsky is accused of crimes, there is a disturbing abundance of silence on his part in the leak of data. Did Dubrovsky attempt to profit from crime that he did not commit? Frequently, such silence means the police/FBI have something to hide.
Re: (Score:2)
Oh goody, scapegoat #1 has been arrested and scapegoat #2 fired. Now how about the spoils-system appointed idiots who chose a platform less secure than a random gooner gatcha?
Re: (Score:2)
Dingus, that was merely a fact tossed out as context for the events in the story. His arrest has nothing to do with the non-installed security patch, except that the lack of the security patch allowed the cyber crime that he's accused of participating in.
Re: (Score:2)
The guy wasn't charged with failing to install updates.
Dubrovsky is facing charges related to extortion and making threats.
Re: (Score:2)
While Dubrovsky is accused of crimes, there is a disturbing abundance of silence on his part in the leak of data. Did Dubrovsky attempt to profit from crime that he did not commit? Frequently, such silence means the police/FBI have something to hide.
Dear Moron,
That information is part of an ongoing investigation. All the public can expect to learn before the trial is the specific statutory charges; not what the evidence is. Only a complete moron thinks that it would be normal for the evidence to be made public before the trial. It's not the norm. You're simply ignorant of even the basic steps involved in the thing you're ranting about being done wrong.
As for the latter part, no. Absolutely not. The police always have something to hide it doesn't ma
Summary needs better attribution (Score:4, Informative)
The first line of the summary should read:
Security researcher Brian Krebs reports (in a story retyped by CNN):
Almost everything in the CNN story is from Krebs [krebsonsecurity.com].
(A t least CNN gave credit to Krebs; not every outlet does that).
Operations resist change. (Score:5, Interesting)
I'm not saying this is the case in this event. But it could be a factor.
In almost all organisations I have worked in, the Operations area resists change. There is good reason for operations to resist change. Change adds risk. In sensitive environment any level of risk is to be avoided.
Specifically almost all operational areas have an up time KPI. Changes especially frequent changes present a risk to up time. Most if not all operational managers are have a pay component tied to uptime/availability.
Secondly it's often quite common for operations to also own the patch cycle. This is fairly straight forward at the OS level and standard apps level. It's not so straight forward with vendor and PaaS / SaaS platforms. PaaS/SaaS platforms often have data transforms attached to the patches and upgrades. Operational managers are NOT application owners. They generally have very little understanding of how the platforms are used, what is important and how the day to day works of business workflows. So generally operational managers will not patch platforms at all unless someone else takes the responsibility and accountability.
So it is possible that this exec had conflicting responsibilities and did not understand the risks of not patching vs other responsibilities like uptime.
( I have avoided the topics related to devops and agentic owned environments. I don't believe either of these apply in this case. )
Re: (Score:3)
You say this like it's a bad thing. For many things, operational uptime is related to production capacity - if a server goes down, production can go down. It's where the "we lose a million dollars a minute" stuff comes from. Operations goal is to keep the service running so that doesn't happen.
I
Re: (Score:2)
-1, off topic
Nothing stated links any company where Dubrovsky was an executive with the fired contractor who allegedly failed to install a patch.
what? (Score:2)
The headline makes it look like he was arrested merely for the business not doing updates. While many of us have significant sympathy for that kind of action, from the only charges found not sealed so far they seem to be claiming that he was making threats of not doing his job. But that could easily be the result of someone not understanding what they were being told, so really we know nothing at all about what the charges are actually based on.
The comments on the linked article seem relatively informative.
Re: (Score:3)
The problem is that the submission contains two stories but the headline only describes one of them.
I've got mixed feelings (Score:3)
We've long said that execs who failed to secure their systems needed jail time.
In this case, it's Kash Patel, with egg on his face, jailing a Canadian... Just dunno
LOL
Re: (Score:2)
The title makes it sound like the guy was arrested for failing to update the software. But in fact:
Dubrovsky is facing charges related to extortion and making threats.
Politically motivated? (Score:3)
I think its time for some significant maintenance on the electrical grid.....