ShinyHunters member 'Rey' reportedly detained in Jordan and cooperating with FBI

A suspected member of the ShinyHunters extortion group known online as "Rey" has been detained in Jordan and is cooperating with the FBI and international law enforcement, Reuters reported on October 3, citing three people with knowledge of the matter. BleepingComputer, which also covered the report, said the suspect has been identified as Saif al-Din Khader. If confirmed, the cooperation of a long-active figure could give investigators a direct view into one of the most prolific data theft and extortion crews of recent years.

What happened

According to Reuters, Jordanian authorities took Khader into custody on Tuesday of this week. Sources told the news agency that he is now walking law enforcement through his electronic devices and digital communications to help identify and locate his alleged co-conspirators. "His cooperation is critical to ongoing efforts to arrest these hackers," one source was quoted as saying. Reuters said it could not immediately determine the circumstances of the detention or Khader's current whereabouts, and the details have not been publicly confirmed by Jordanian or US authorities.

The FBI declined to comment on specific arrests, but told Reuters that it "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects." FBI Director Kash Patel wrote on X that FBI teams were working new leads and that more arrests were possible, according to the report.

The FBI breach claim

The detention comes after ShinyHunters claimed in September that it had breached FBI systems. BleepingComputer reported that the group said it exploited an Oracle PeopleSoft vulnerability and stole 2 to 3 TB of data, including employee information and sensitive records. According to Reuters, the group claims to hold data on every FBI employee, including personal information, sensitive job roles, and psychiatric and medical records. These claims have not been independently verified.

Dutch police arrested 24-year-old Pepijn van der Stap, alias "Umbreon", on September 15 as part of the same investigation, BleepingComputer said. The outlet added that on the same day Khader was reportedly detained, the ShinyHunters data leak site went offline and the group's communications stopped, although a new site later appeared. ShinyHunters operators told Reuters that the group wanted "no further escalation" with the FBI.

Who is Rey

BleepingComputer reported that Rey has been linked to breaches at Telefónica in January 2025, Orange Romania in February 2025 and Jaguar Land Rover in March and September 2025, as well as to the HellCat ransomware operation and the "Scattered Lapsus$ Hunters" collective. In November 2025, KrebsOnSecurity identified him and reported that he claimed to have been cooperating with law enforcement since June of that year.

What it means for defenders

Arrests rarely end such groups overnight, and a new leak site has already surfaced. Organizations that have received extortion demands from ShinyHunters or related groups should preserve evidence and report incidents to law enforcement, and should continue reviewing access to SaaS and enterprise applications, the type of systems the group has repeatedly targeted.