ShinyHunters Hacker Detained in Jordan Assists FBI Investigation
A suspected member of the ShinyHunters hacking group, known online as "Rey" and identified as Saif al-Din Khader, has reportedly been detained in Jordan and is now cooperating with the FBI to help locate other members of the extortion group. According to Reuters, Jordanian authorities took Khader into custody this week, with two sources confirming his arrest occurred on Tuesday. The detention marks a significant development in the ongoing international effort to dismantle the ShinyHunters network.
Cooperation with Law Enforcement Underway
Two sources familiar with the arrest told Reuters that Khader is actively assisting the FBI and international law enforcement agencies in tracking down alleged co-conspirators. One source indicated that Khader is guiding investigators through his electronic devices and digital communications to identify and locate other individuals involved in the group's criminal activities. "His cooperation is critical to ongoing efforts to arrest these hackers," a source told Reuters, underscoring the strategic value of his assistance.
Connection to FBI Breach and Extortion Campaign
The reported detention comes amid an FBI crackdown on ShinyHunters following the group's claimed cyberattack on bureau systems. In September, ShinyHunters told BleepingComputer that it breached FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability before moving laterally into FBI-managed AWS GovCloud systems. The threat actors claimed they stole between 2TB and 3TB of data, including information belonging to current and former FBI employees, job applicants, medical and psychiatric information, and records from internal services.
BleepingComputer has not independently verified the alleged zero-day exploit, lateral movement, or the volume of stolen data. The FBI previously confirmed it was investigating claims of unauthorized activity but did not confirm that data had been stolen.
Recent Arrests and Disruption to ShinyHunters Operations
Following the FBI breach allegations, Dutch police arrested a 24-year-old Amsterdam man on September 15 as part of an investigation into ShinyHunters. The suspect, identified by KrebsOnSecurity and DataBreaches as Pepijn van der Stap, previously used the online alias "Umbreon." After the arrest, the FBI publicly urged other ShinyHunters members to turn themselves in, stating investigators were still identifying those involved with the group.
FBI Cyber Division Assistant Director Brett Leatherman emphasized the effectiveness of law enforcement pressure, stating: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."
On Tuesday, the same day Khader was reportedly detained, signs of disruption emerged within the ShinyHunters operation. An alleged affiliate who had previously contacted BleepingComputer and other media about the FBI attack and a recent Clop ransomware gang data breach abruptly shut down their online messaging account. Shortly after, the ShinyHunters data leak site went offline, and the group's main representative stopped responding to media inquiries from outlets including BleepingComputer and Reuters.
Background on Saif al-Din Khader (Rey)
The threat actor known as Rey has been linked to multiple data theft and extortion attacks over the past two years. In January 2025, Rey was one of four threat actors who claimed responsibility for a breach of Telefónica's internal Jira ticketing system, where approximately 2.3GB of documents, tickets, and other data were allegedly stolen. BleepingComputer previously reported that Rey and two of the other attackers were members of the then-new HellCat ransomware operation.
In February 2025, Orange confirmed that its Romanian operations suffered a cyberattack after Rey leaked approximately 6.5GB of stolen data. Rey told BleepingComputer at the time that he was a member of HellCat but had conducted the Orange breach independently. He was later linked to the ShinyHunters extortion group and was seen with administrative privileges in Telegram channels operated by "Scattered Lapsus$ Hunters."
Scattered Lapsus$ Hunters, first observed in 2025, claimed to consist of former members of the Lapsus$, Scattered Spider, and ShinyHunters cybercrime groups. The group claimed responsibility for the September 2025 cyberattack on Jaguar Land Rover that forced the automaker to halt production for weeks and ultimately cost the company more than $220 million. Rey was also linked to an earlier March 2025 breach of Jaguar Land Rover, during which he allegedly leaked gigabytes of data, including Jira issues, source code, employee information, and development logs.
Prior Contact with Journalist Brian Krebs
In November 2025, security journalist Brian Krebs reported that Rey was Saif Al-Din Khader after analyzing information from infostealer logs and speaking directly with Khader over Signal. Krebs reported that Khader said he was trying to distance himself from Scattered Lapsus$ Hunters and claimed he had been cooperating with law enforcement since at least June. "I'm already cooperating with law enforcement," Khader allegedly told Krebs. "In fact, I have been talking to them since at least June. I have told them nearly everything. I haven't really done anything like breaching into a corp or extortion related since September." Krebs said he could not verify those claims.
Ongoing Impact and Group Resilience
It remains unclear whether the sudden silence and shutdown of ShinyHunters-linked infrastructure are directly connected to Khader's reported detention. However, on Thursday, a new ShinyHunters data leak site went online, suggesting that other members continue to operate the extortion operation. BleepingComputer contacted ShinyHunters regarding Rey's reported detention but has not received a response.
The ShinyHunters gang has long posed a significant challenge to law enforcement, conducting large-scale data theft attacks and extortion campaigns against organizations worldwide. In recent years, the group has focused on Salesforce and other cloud SaaS environments, with campaigns linked to breaches at Google, Cisco, and PornHub. The extortion gang commonly breaches third-party integration companies and uses stolen authentication tokens to access connected SaaS environments and steal customer data.
The group was also behind a massive data-theft attack on Instructure Canvas in May that caused significant platform outages. The company eventually reached an "agreement" with the threat actors to prevent the stolen data from being leaked online. Over the years, numerous arrests have been linked to the ShinyHunters name, including suspects connected to the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum.
Source: BleepingComputer